book-serif-index
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEOBFUSCATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) which decodes to the complete HTML and JavaScript source for a design demonstration. This is used as a packaging mechanism for the skill's visual preview. - [EXTERNAL_DOWNLOADS]: The skill configuration and demo files reference scripts and assets from well-known services, including Cloudflare's CDN (GSAP, Three.js), Tailwind CSS, Iconify, and Supabase for image hosting. These sources are reputable technology providers.
- [INDIRECT_PROMPT_INJECTION]: The recreation instructions in
demo/PROMPT.mddirect the agent to analyze a specific vendor URL (https://neuform.ai/pages/omni-corporate-neural-memory/index.html) to inform the design generation. While this creates a data ingestion surface, the target is the vendor's own documentation site. - [DYNAMIC_EXECUTION]: The demo implementation in
demo/index.htmldynamically generates asrcdocfor a sandboxed iframe using the decoded Base64 content. This execution is confined to a restricted environment with a strict Content Security Policy (CSP) that prevents external connections and frame escapes.
Audit Metadata