js-animation
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill identifies and provides code to load animation and 3D libraries from established and trusted Content Delivery Networks (CDNs) such as jsDelivr and Cloudflare. This is standard practice and follows the intended use-case of the skill.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection in 'Mode A', which involves reading existing HTML files to find animation opportunities. It does not provide instructions to the agent to distinguish between code to be animated and instructions embedded in the file.
- Ingestion points: User-provided HTML files read during Phase 0 (Mode A).
- Boundary markers: Absent; no delimiters are defined to separate user content from system instructions.
- Capability inventory: The skill generates and modifies code, though it does not perform direct system or network operations.
- Sanitization: Absent; the skill does not specify any validation or sanitization of the external content being processed.
Audit Metadata