container-lines

Warn

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [OBFUSCATION]: The demo wrapper in demo/index.html contains a large Base64-encoded string named encodedHtml. This string decodes to a complete HTML document including internal script logic and structural details, effectively hiding the demo's implementation from simple text-based security scans.
  • [DYNAMIC_EXECUTION]: The skill employs dynamic execution by decoding the encodedHtml string and injecting it into an iframe's srcdoc attribute at runtime. It also uses URL.createObjectURL to dynamically instantiate binary assets (such as images) that have been decoded from Base64 data passed via cross-document messaging.
  • [EXTERNAL_DOWNLOADS]: The skill and its demo components reference external resources from well-known services, including Cloudflare (GSAP library), Tailwind CSS, Iconify, Google Fonts, and Supabase (for image hosting). While these are established services, they represent a dependency on external code and assets.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 14, 2026, 02:33 PM