gsap-scrolltrigger-storytelling
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's demo fetches several runtime libraries and configuration assets from well-known technology providers and content delivery networks.
- Downloads GSAP and ScrollTrigger animation libraries from Cloudflare's public CDN (cdnjs).
- Loads the Tailwind CSS runtime for styling from Tailwind's official CDN.
- Integrates Iconify icon components from the official Iconify runtime service.
- Fetches typography and web fonts from Google Fonts and Fontshare's established infrastructure.
- [OBFUSCATION]: The
demo/index.htmlfile utilizes a large Base64-encoded string (encodedHtml) to deliver the demo's visual payload. - This string decodes to a complete HTML/CSS/JS document representing the product storytelling UI.
- The content is benign and serves the skill's primary purpose of demonstrating scroll-based interaction patterns.
- This approach is identified as a technical bundling method used by the author to maintain a portable, sandboxed demo environment.
- [INDIRECT_PROMPT_INJECTION]: The skill documentation and demo prompts refer to external design references for visual guidance.
- Ingestion points: The skill refers the agent to a reference URL on the author's domain (
neuform.ai) to analyze design fidelity. - Boundary markers: Explicit markers are absent in the prompt templates, but the instructions focus strictly on visual and structural recreation.
- Capability inventory: The skill generates frontend code (HTML/JS) and utilizes external animation libraries.
- Sanitization: Not applicable as the skill primarily guides generation rather than processing untrusted user data at runtime.
- [DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive file access or exfiltration behaviors were detected. The demo includes mock financial metrics which are updated locally via client-side JavaScript for visual effect only.
Audit Metadata