gsap-scrolltrigger-storytelling

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's demo fetches several runtime libraries and configuration assets from well-known technology providers and content delivery networks.
  • Downloads GSAP and ScrollTrigger animation libraries from Cloudflare's public CDN (cdnjs).
  • Loads the Tailwind CSS runtime for styling from Tailwind's official CDN.
  • Integrates Iconify icon components from the official Iconify runtime service.
  • Fetches typography and web fonts from Google Fonts and Fontshare's established infrastructure.
  • [OBFUSCATION]: The demo/index.html file utilizes a large Base64-encoded string (encodedHtml) to deliver the demo's visual payload.
  • This string decodes to a complete HTML/CSS/JS document representing the product storytelling UI.
  • The content is benign and serves the skill's primary purpose of demonstrating scroll-based interaction patterns.
  • This approach is identified as a technical bundling method used by the author to maintain a portable, sandboxed demo environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill documentation and demo prompts refer to external design references for visual guidance.
  • Ingestion points: The skill refers the agent to a reference URL on the author's domain (neuform.ai) to analyze design fidelity.
  • Boundary markers: Explicit markers are absent in the prompt templates, but the instructions focus strictly on visual and structural recreation.
  • Capability inventory: The skill generates frontend code (HTML/JS) and utilizes external animation libraries.
  • Sanitization: Not applicable as the skill primarily guides generation rather than processing untrusted user data at runtime.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive file access or exfiltration behaviors were detected. The demo includes mock financial metrics which are updated locally via client-side JavaScript for visual effect only.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 01:38 PM
Security Audit — agent-trust-hub — gsap-scrolltrigger-storytelling