transition-craft
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]:
- The skill fetches the GSAP animation library from the jsDelivr CDN (
https://cdn.jsdelivr.net/npm/gsap@3.14.2/dist/gsap.min.js). - This is a standard and expected dependency for the animation logic used in the transition templates.
- [COMMAND_EXECUTION]:
- The demo project includes scripts in
package.jsonandREADME.mdto runhyperframesvianpxfor checking, previewing, and rendering video. - A utility script
tools/gen-shots.tsis provided to generate sample vector illustrations using thenode:fsmodule. This script runs locally to prepare demo assets. - [DYNAMIC_EXECUTION]:
- Composition templates (
.htmlfiles) contain embedded JavaScript that calculates animation easing, SVG paths, and CSS filter values at runtime. - This logic is used exclusively for visual rendering and does not incorporate or execute untrusted external input.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided media assets (photos and video clips) enter the agent's context through references in the editing workflow in
SKILL.md. - Boundary markers: Absent.
- Capability inventory: The skill utilizes subprocess execution via
npx hyperframesfor rendering operations (package.json). - Sanitization: Assets are used strictly as image/video sources in fixed code templates and are not interpolated into command strings or prompt instructions.
Audit Metadata