skills/varghq/skills/transition-craft/Gen Agent Trust Hub

transition-craft

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]:
  • The skill fetches the GSAP animation library from the jsDelivr CDN (https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js).
  • This is a standard and expected dependency for the animation logic used in the transition templates.
  • [COMMAND_EXECUTION]:
  • The demo project includes scripts in package.json and README.md to run hyperframes via npx for checking, previewing, and rendering video.
  • A utility script tools/gen-shots.ts is provided to generate sample vector illustrations using the node:fs module. This script runs locally to prepare demo assets.
  • [DYNAMIC_EXECUTION]:
  • Composition templates (.html files) contain embedded JavaScript that calculates animation easing, SVG paths, and CSS filter values at runtime.
  • This logic is used exclusively for visual rendering and does not incorporate or execute untrusted external input.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: User-provided media assets (photos and video clips) enter the agent's context through references in the editing workflow in SKILL.md.
  • Boundary markers: Absent.
  • Capability inventory: The skill utilizes subprocess execution via npx hyperframes for rendering operations (package.json).
  • Sanitization: Assets are used strictly as image/video sources in fixed code templates and are not interpolated into command strings or prompt instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 12:01 PM