skills/zapabob/skills/pretext/Gen Agent Trust Hub

pretext

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches library dependencies including pretext, GSAP animation engine, and lil-gui controls from the esm.sh CDN. It also downloads font assets from Google Fonts and jsdelivr. These are well-known services commonly used for web development and browser-based demos.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and render user-provided text strings within generated HTML demos. This ingestion occurs in the generated HTML templates where text variables are defined (e.g., in donut-orbit.html and hello-orb-flow.html). The generated scripts possess capabilities for Canvas 2D rendering and DOM manipulation but lack system-level access. While boundary markers like explicit instructions to ignore embedded commands are absent, the templates implement sanitization via the escapeHTML function which replaces characters like ampersands and angle brackets before rendering text to the DOM.
  • [DYNAMIC_EXECUTION]: The skill's primary function is to generate and facilitate the execution of HTML files containing JavaScript to perform canvas-based typography. This dynamic script generation follows predefined templates and is restricted to the client-side browser environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:08 PM