clean-minimal-beige-light-mode
Warn
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) that encapsulates the entire HTML structure and logic of the design demo. This obscures the code from plain-text inspection and static analysis. - [DYNAMIC_EXECUTION]: The design demo dynamically compiles WebGL shaders at runtime within the browser to create background visual effects. This involves the use of
gl.shaderSourceandgl.compileShaderon strings defined within the embedded HTML payload. Additionally, the skill utilizessrcdocto dynamically inject and execute the decoded HTML content into an iframe. - [INDIRECT_PROMPT_INJECTION]: The demo prompts in
demo/PROMPT.mddescribe a workflow where the agent ingests external product briefs, concept anchors, and subject tags (e.g., for the 'MentorBridge' project). This represents an ingestion surface where malicious instructions could be embedded in the data being processed by the agent to influence the design output or logic. - [EXTERNAL_DOWNLOADS]: The
demo/source.jsonmetadata file references external dependencies from well-known services including Cloudflare (GSAP and ScrollTrigger libraries), Iconify, and Tailwind CSS. These are documented as standard runtime dependencies for the design's functionality.
Audit Metadata