gsap
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external resources, all of which are from well-known and trusted providers:
- Fetches fonts and stylesheets from Google's official
fonts.googleapis.comandfonts.gstatic.comdomains. - The
demo/source.jsonmetadata reveals that runtime dependencies (GSAP, Three.js, Draggable) are sourced fromcdnjs.cloudflare.com, which is a well-known public CDN. - The Iconify library is fetched from
code.iconify.design. - Demo assets are stored on
supabase.co, a well-known backend service. - [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml). Upon decoding, this string reveals the standard HTML structure for the demo page, including a Content Security Policy (CSP), Tailwind CSS configuration, and GSAP animation logic. This is a common technique for packaging demo content within a single file and does not represent a malicious attempt to hide behavior. - [COMMAND_EXECUTION]: The skill instructions and scripts focus on client-side web animations and 3D rendering using Three.js and GSAP. There are no patterns of dangerous shell command execution, privilege escalation, or persistence mechanisms detected.
Audit Metadata