cinematic-gsap-lenis-motion-system
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include installation commands for the 'gsap' and 'lenis' Node.js packages. Both are well-known and standard industry libraries for web animation and smooth scrolling.
- [INDIRECT_PROMPT_INJECTION]: The skill code processes text content from the DOM to create staggered animation effects, which represents a potential ingestion point for untrusted data. 1. Ingestion points: Text is read from DOM elements using .textContent in the splitWords and splitLines functions within SKILL.md. 2. Boundary markers: None; the skill operates on the raw text content of designated elements. 3. Capability inventory: Capabilities are limited to client-side DOM manipulation and visual animations; no high-privilege operations such as shell execution or network requests are triggered by the data. 4. Sanitization: The use of .textContent and manual element creation provides safety against Cross-Site Scripting (XSS), though it does not sanitize the semantic content of the strings.
Audit Metadata