anima-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the official
@animaapp/anima-sdkand references documentation fromdocs.animaapp.com. These are legitimate resources associated with the Anima design platform.\n- [COMMAND_EXECUTION]: Employs standard Node.jsfsmodule functions, such asmkdirSyncandwriteFileSync, to organize and save generated React/HTML components locally.\n- [SAFE]: Handles sensitive authentication tokens securely viaprocess.env.ANIMA_TOKEN, avoiding hardcoded secrets in the source code.\n- [SAFE]: The skill processes data from cloned websites to generate and transform code, which constitutes an indirect prompt injection surface. However, the logic uses deterministic regex transformations and local file operations rather than passing untrusted content directly to LLM instructions.\n - Ingestion points: File content arrays in
customizeGeneratedCodeandorganizeGeneratedFiles.\n - Boundary markers: Not present in the provided utility functions.\n
- Capability inventory: Local file writing (
fs.writeFileSync) and directory creation (fs.mkdirSync).\n - Sanitization: No explicit sanitization of website content is performed beyond standard string replacements.
Audit Metadata