animate-css-skill
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is a catalogue stub that directs the agent to download and install its full implementation from an external repository located at
https://github.com/msrbuilds/animate-css-skill. The repository is owned by an unknown third-party user ('msrbuilds') which does not match the skill's author ('podo'), posing a supply chain risk. - [COMMAND_EXECUTION]: The documentation provides explicit instructions to execute the command
npx skills add msrbuilds/animate-css-skill. Running installation commands for packages from unverified sources can lead to arbitrary code execution if the external package or its setup script is compromised. - [COMMAND_EXECUTION]: The skill instructions suggest using the
!prefix for installation (e.g.,! npx skills add ...). On certain agent platforms, this syntax triggers immediate shell execution at load time, which could lead to automated execution of untrusted code without sufficient user oversight.
Audit Metadata