gsap-interactions

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's Auto-Installation step instructs adding CDN script tags that are fetched and executed at runtime (e.g., https://cdn.jsdelivr.net/npm/gsap@3/dist/gsap.min.js and the plugin URLs https://cdn.jsdelivr.net/npm/gsap@3/dist/ScrollTrigger.min.js and https://cdn.jsdelivr.net/npm/gsap@3/dist/SplitText.min.js), and those remote JS files are required dependencies for the skill to run.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly mandates auto-installation of system-level software (FFmpeg) using platform package managers — including an explicit "sudo apt-get install -y ffmpeg" and other installer commands — which requires elevated privileges and modifies the host system, so it pushes the agent to change the machine's state.