The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64 encoded string assigned to the variable encodedHtml. This string decodes to the complete HTML, CSS, and JavaScript source for the 'Auralis' design demo. While used for packaging the demo, embedding executable code in Base64 is a technique that can be used to hide malicious logic.\n- [DYNAMIC_EXECUTION]: The script within demo/index.html performs dynamic code execution by decoding the encodedHtml string and assigning it to the srcdoc attribute of an iframe. It also dynamically creates Blob objects and ObjectURLs from data received via window messages to inject assets into the demo frame.\n- [INDIRECT_PROMPT_INJECTION]: The demo environment in demo/index.html exposes an attack surface by listening for postMessage events (neuform-assets-v1) to ingest external asset data. The skill mitigates this risk by using a sandboxed iframe (sandbox='allow-scripts') and a restrictive Content Security Policy (CSP) defined within the decoded HTML to prevent unauthorized network access or script execution outside the sandbox.\n- [EXTERNAL_DOWNLOADS]: The skill's demo configuration in demo/source.json references several third-party runtime dependencies, including GSAP, Three.js, and Iconify, which are fetched from well-known services such as Cloudflare's CDN and official package registries.

beautiful-shadows