C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools, Web & browsing
scroll-craft
An agent skill for building premium, immersive, scroll-driven websites. Works with Codex, Claude Code, and other coding agents. Also available as a Claude Code plugin.
Bottom line: Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code audit.
- Popularity score
- 40/100
- Rank
- Not ranked: outside the 500 most popular tools
- GitHub stars
- 3.5k
What it does
scroll-craft is an AI agent skill that enables developers to programmatically build premium, scroll-driven websites with immersive animations and interactions. It integrates with coding agents like Codex and Claude Code to automate the generation of scroll-based web experiences.
Who it’s for
Web developers and builders using AI coding agents who want to quickly scaffold scroll-driven landing pages, portfolios, or marketing sites. Executives evaluating AI-assisted web development workflows.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/nateherkai/scroll-craft (opens external site) for current installation instructions. Likely installation: npm install scroll-craft or equivalent. For Claude Code plugin use, check the repository's plugin documentation or Claude Desktop integration guide.
Risks
- Prompt injection: Agent-generated scroll animations or event handlers could inadvertently execute user-supplied content if not properly sanitized
- Dependency chain: As an npm package, vulnerable to supply-chain attacks if maintainer account is compromised
- Data handling unclear: No explicit documentation visible on what data (if any) is transmitted during code generation or preview rendering
- Client-side code generation: Generated JavaScript could contain vulnerabilities if the agent produces unsafe DOM manipulation patterns
- Maintenance uncertainty: Zero weekly npm downloads suggests limited active usage, which may impact security response velocity
How to stay secure
Scroll-Craft Security Hardening Guide
Least-privilege permissions
- Restrict agent access: Only grant the skill permission to generate code for trusted projects; disable it for sensitive applications handling payment, health, or personal data
- Sandbox code review: Require a human developer to review all generated code before publishing to production—don't auto-deploy agent output
- Limit integration scope: If using as a Claude Code plugin, connect it to a staging environment only, not your live website or admin systems
- Isolate npm credentials: Use separate, read-only npm accounts for dependency installation; never share maintainer credentials with automated tools
Network isolation
- Preview in isolated sandbox: Test generated website previews in a separate browser profile or virtual machine, not your main work environment
- Block outbound calls: Configure your network or firewall to prevent the agent tool from transmitting code, design files, or analytics data to external servers without explicit approval
- Disable third-party animations: Remove or audit any pre-built animation libraries included by default; verify they don't phone home or load remote scripts
- VPN for development: Use a VPN when working with scroll-craft to prevent interception of generated code or design specifications
Monitoring
- Audit generated code for patterns: Spot-check agent output for risky JavaScript patterns like
eval(),innerHTMLwithout sanitization, or dynamic event handler injection - Track npm package updates: Subscribe to security alerts for scroll-craft and its dependencies; immediately review changelogs before updating
- Monitor preview requests: Log and review what data (if any) is sent when rendering previews; disable telemetry or analytics if available
- Version lock dependencies: Freeze npm package versions in your project; don't auto-update—only upgrade after manual review and testing
Red flags to watch for
- Unreviewed code in production: Any website element generated by the agent that reaches live users without human approval is a security risk
- Mixed trusted and untrusted input: If the agent pulls content from user-submitted forms, database fields, or APIs and embeds it directly in animations or handlers, stop and sanitize first
- Unexplained network activity: If your build process or preview slows down, or you see outbound connections not explained by the tool's documentation, investigate immediately
- No updates or response from maintainers: If the package shows zero downloads or hasn't been patched in 6+ months, treat it as abandoned and consider a maintained alternative
Alternatives
- Framer Motion — mature library with broader adoption for scroll and gesture-driven animations
- GSAP ScrollTrigger — industry-standard scroll animation plugin with extensive documentation
- Lenis + Three.js — lower-level combo for high-fidelity scroll physics and 3D immersion
- Webflow — visual builder with native scroll animation support (less code-agent focused)