mask-reveal-transition
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides links to the author's GitHub repository (github.com/Rheinmir/uiux-asset) and suggest using git clone to fetch UI assets. These resources are hosted on the author's own infrastructure and are provided as reference material.
- [INDIRECT_PROMPT_INJECTION]: The JavaScript logic in assets/mask-reveal-transition.js reads image sources from data attributes and updates DOM elements.
- Ingestion points: data-mrt-src attributes within .mrt-split-panel elements in assets/demo.html and SKILL.md examples.
- Boundary markers: No specific delimiters or boundary markers are present to isolate the external attribute values.
- Capability inventory: The skill modifies DOM attributes (img.src) and updates CSS custom properties (setProperty). It does not have access to sensitive file operations or network exfiltration tools.
- Sanitization: The logic retrieves data-mrt-src values and assigns them directly to the image source without explicit sanitization or validation.
Audit Metadata