blur

SUSPICIOUS. The stated purpose is coherent, but the runtime trust model is not production-safe because core behavior depends on a mutable third-party CodePen script and an undeclared external GSAP source. There is no credential theft or obvious malicious behavior, yet the external dependency chain is broader and less verifiable than the skill’s narrow visual purpose requires.