gsap
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file demo/index.html uses a Base64-encoded string to store the source code for a design demonstration. This is a common method for bundling demo content into a single file. Decoding the content confirms it is a standard HTML document for a UI landing page.
- [DYNAMIC_EXECUTION]: The demo environment in demo/index.html dynamically populates a sandboxed iframe using the srcdoc attribute with content decoded from a Base64 string at runtime. This allows for a self-contained preview of GSAP animations.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references runtime libraries and assets from well-known services, including Google Fonts, Cloudflare's CDN for GSAP and Three.js, and Tailwind CSS. These sources are considered safe and standard for web development.
- [INDIRECT_PROMPT_INJECTION]: The skill includes a visual reference (demo/index.html) meant for the agent to analyze and emulate. The processing of this external reference is controlled within a sandboxed environment with a strict Content Security Policy (CSP).
Audit Metadata