gsap-scrolltrigger-pin

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads assets and reference code from the author's repository at github.com/Rheinmir/uiux-asset and a corresponding hosted mirror on rheinmir.github.io. These are vendor-owned resources and part of the expected functionality.
  • [EXTERNAL_DOWNLOADS]: The implementation relies on the GSAP and ScrollTrigger libraries hosted on Cloudflare's CDN (cdnjs.cloudflare.com). These are well-known and reputable services.
  • [COMMAND_EXECUTION]: The workflow involves using playwright-verify to perform automated testing of the generated layout in a headless browser to ensure proper pinning and responsive behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and images to populate the scrollable slides, which creates a potential surface for indirect injection if the input contains executable scripts or malicious instructions.
  • Ingestion points: Slide content for portfolio, case studies, or product sections (SKILL.md).
  • Boundary markers: None explicitly defined in the provided assets; the agent is instructed to adapt content into the [data-hp-slide] elements.
  • Capability inventory: File system write operations for HTML/CSS/JS and execution of Playwright for verification.
  • Sanitization: No explicit filtering or sanitization of input content is specified before it is injected into the HTML templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 02:25 AM