glass-neon-motion

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project briefs and external design references (e.g., from wowpovod.ru, Pinterest, and Dribbble) to generate and export frontend code. This creates a surface for indirect prompt injection if the ingested data contains malicious instructions targeting the agent's code generation capabilities.
  • Ingestion points: SKILL.md (briefs, project files), references/user-reference-direction.md (24 external design reference links).
  • Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" warnings for external data, relying on general agent caution.
  • Capability inventory: The skill instructs the agent to write and export HTML, CSS, and JavaScript files (references/code-export.md), which could be misused if injected instructions influence the output.
  • Sanitization: The documentation in references/html-atlas.md and references/collections-typography.md explicitly advises against executing scripts from examples and using textContent for dynamic values, showing awareness of common injection risks.
  • [EXTERNAL_DOWNLOADS]: The skill includes shell commands for its own installation and update using a platform-specific CLI tool (npx skills add) that fetches code from the author's repository on GitHub.
  • Evidence: references/installation.md provides commands targeting github.com/rdsolod-ui/glass-neon-motion-skill for both Codex and Claude Code agents.
  • Context: These resources belong to the skill's author (rdsolod-ui) and represent standard installation procedures for the intended environment.
  • [EXTERNAL_DOWNLOADS]: The documentation (references/stack.md) recommends the installation of various well-known frontend libraries and development tools such as GSAP, Radix UI, and Vite.
  • Context: These are reputable third-party dependencies commonly used in web development and are provided as optional choices based on project needs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 10:04 AM