web-motion-animation
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches animation libraries from well-known services including jsDelivr, Skypack, and Vercel. These resources are standard in web development for accessing tools like GSAP.
- [INDIRECT_PROMPT_INJECTION]: The skill contains logic to read text content directly from the DOM (e.g., hero titles and count-up values) to apply animations. This ingestion of untrusted data from the web page creates an indirect prompt injection surface where page content could influence the agent's processing logic.
- Ingestion points:
heroTitle.textContentin Step 3 anddataset.countupin Step 4. - Boundary markers: None present.
- Capability inventory: DOM manipulation, script injection, and text transformation.
- Sanitization: No explicit sanitization or filtering is performed on the ingested text before it is re-processed or updated.
- [DYNAMIC_EXECUTION]: The skill utilizes runtime compilation for WebGL shaders, defining fragment shader logic as strings that are compiled by the browser at runtime. This is a standard and expected pattern for WebGL-based graphics.
Audit Metadata