mask-reveal-transition
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides instructions to download original assets and code from the author's GitHub repository (Rheinmir/uiux-asset).
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from HTML attributes to control the component's state.
- Ingestion points: Image sources are read from data-mrt-src attributes in assets/demo.html and processed by assets/mask-reveal-transition.js.
- Boundary markers: No explicit delimiters or safety warnings are present; values are treated as literal strings for image sources.
- Capability inventory: The component updates image sources and CSS custom properties in the DOM.
- Sanitization: No explicit sanitization or validation of the source URLs is performed before assignment to image elements.
Audit Metadata