Skip to content
skillsafebeta
← Report library
Purpose / Other

Gsap Plugins Skill Security Audit

What the author says it does (original text)

Official GSAP skill for GSAP plugins — registration, ScrollToPlugin, ScrollSmoother, Flip, Draggable, Inertia, Observer, SplitText, ScrambleText, SVG and physics plugins, CustomEase, EasePack, CustomWiggle, CustomBounce, GSDevTools. Use when the user asks about a GSAP plugin, scroll-to, flip animations, draggable, SVG drawing, or plugin registration.

Independent security check

Low-risk issues found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This is an active installation instruction, and `npm install gsap` does not specify a version. When run, npm may resolve whatever version is available then, so installations at different times can contain different code, reducing reproducibility and exposing the project to future release or supply-chain changes. This does not show that the package is malicious. Users can ask for a tested version and require a lockfile with locked installation.

SKILL.md:19In the instructionsOpen original file
- ✅ Install everything from the public `gsap` npm package: `npm install gsap`. All plugins are included — import them as `gsap/SplitText`, `gsap/MorphSVGPlugin`, etc.- ❌ Do **not** generate an `.npmrc` with a GreenSock auth token, suggest the private `npm.greensock.com` registry, or tell users to sign up for Club GSAP to access a plugin. Those instructions are outdated.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a usage guide for GSAP plugins. Its only explicit installation step uses the public `gsap` npm package, and it explicitly rejects creating an `.npmrc` with an authentication token or using a private registry.

View source
SKILL.md:19In the instructionsOpen original file
- ✅ Install everything from the public `gsap` npm package: `npm install gsap`. All plugins are included — import them as `gsap/SplitText`, `gsap/MorphSVGPlugin`, etc.- ❌ Do **not** generate an `.npmrc` with a GreenSock auth token, suggest the private `npm.greensock.com` registry, or tell users to sign up for Club GSAP to access a plugin. Those instructions are outdated.

Its main instruction is to import and register required plugins in a project and then use example code for page animations. The provided source contains no scripts, command downloaders, credential access, or data-upload logic.

View source
SKILL.md:24In the instructionsOpen original file
Register each plugin once so GSAP (and bundlers) know to include it. Use **gsap.registerPlugin()** with every plugin used in the project:```javascriptimport gsap from "gsap";import { ScrollToPlugin } from "gsap/ScrollToPlugin";import { Flip } from "gsap/Flip";import { Draggable } from "gsap/Draggable";gsap.registerPlugin(ScrollToPlugin, Flip, Draggable);```

Some plugins modify the current page's scroll position or DOM as part of their stated animation purpose. These are openly described example behaviors, not concealed file or account operations.

View source
SKILL.md:47In the instructionsOpen original file
gsap.to(window, { duration: 1, scrollTo: { y: 500 } });gsap.to(window, { duration: 1, scrollTo: { y: "#section", offsetY: 50 } });gsap.to(scrollContainer, { duration: 1, scrollTo: { x: "max" } });```
SKILL.md:84In the instructionsOpen original file
const state = Flip.getState(".item");// change DOM (reorder, add/remove, change classes)Flip.from(state, { duration: 0.5, ease: "power2.inOut" });```

The Skill marks GSDevTools as development-only and explicitly instructs users not to ship it to production.

View source
SKILL.md:398In the instructionsOpen original file
### GSDevToolsUI for scrubbing timelines, toggling animations, and debugging. Use during development only; do not ship. Register and create an instance with a timeline reference.
SKILL.md:426In the instructionsOpen original file
## Do Not- ❌ Use a plugin in a tween or API without registering it first (**gsap.registerPlugin()**).- ❌ Ship GSDevTools or development-only plugins to production.
Start here · InstructionsSKILL.md
gsap-plugins
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 5 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:17In the instructionsOpen original file
Every GSAP plugin is **free**, including for commercial use. Since [Webflow's acquisition of GSAP](https://gsap.com/blog/webflow-GSAP/), Club GSAP is no longer a paid tier and **no plugin requires a membership, license key, or auth token** — this includes formerly Club-only plugins (**SplitText**, **MorphSVG**, etc.).
SKILL.md:101In the instructionsOpen original file
https://gsap.com/docs/v3/Plugins/Flip
SKILL.md:220In the instructionsOpen original file
**Learn more:** [SplitText](https://gsap.com/docs/v3/Plugins/SplitText/)
Install extra software packages
SKILL.md:19In the instructionsOpen original file
- ✅ Install everything from the public `gsap` npm package: `npm install gsap`. All plugins are included — import them as `gsap/SplitText`, `gsap/MorphSVGPlugin`, etc.- ❌ Do **not** generate an `.npmrc` with a GreenSock auth token, suggest the private `npm.greensock.com` registry, or tell users to sign up for Club GSAP to access a plugin. Those instructions are outdated.
Lines read
434
File checksum (to compare versions)
6ebc51dbce9b4ccec78916ffc41d535360c2f8bca3a2c207bc443389d365f45e