container-lines
Warn
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The demo wrapper in
demo/index.htmlcontains a large Base64-encoded string namedencodedHtml. This string decodes to a complete HTML document including internal script logic and structural details, effectively hiding the demo's implementation from simple text-based security scans. - [DYNAMIC_EXECUTION]: The skill employs dynamic execution by decoding the
encodedHtmlstring and injecting it into an iframe'ssrcdocattribute at runtime. It also usesURL.createObjectURLto dynamically instantiate binary assets (such as images) that have been decoded from Base64 data passed via cross-document messaging. - [EXTERNAL_DOWNLOADS]: The skill and its demo components reference external resources from well-known services, including Cloudflare (GSAP library), Tailwind CSS, Iconify, Google Fonts, and Supabase (for image hosting). While these are established services, they represent a dependency on external code and assets.
Audit Metadata