gsap-scrolltrigger-pin
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads assets and reference code from the author's repository at
github.com/Rheinmir/uiux-assetand a corresponding hosted mirror onrheinmir.github.io. These are vendor-owned resources and part of the expected functionality. - [EXTERNAL_DOWNLOADS]: The implementation relies on the GSAP and ScrollTrigger libraries hosted on Cloudflare's CDN (
cdnjs.cloudflare.com). These are well-known and reputable services. - [COMMAND_EXECUTION]: The workflow involves using
playwright-verifyto perform automated testing of the generated layout in a headless browser to ensure proper pinning and responsive behavior. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and images to populate the scrollable slides, which creates a potential surface for indirect injection if the input contains executable scripts or malicious instructions.
- Ingestion points: Slide content for portfolio, case studies, or product sections (SKILL.md).
- Boundary markers: None explicitly defined in the provided assets; the agent is instructed to adapt content into the
[data-hp-slide]elements. - Capability inventory: File system write operations for HTML/CSS/JS and execution of Playwright for verification.
- Sanitization: No explicit filtering or sanitization of input content is specified before it is injected into the HTML templates.
Audit Metadata