framed-grid-layout
Fail
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: HIGHOBFUSCATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The
demo/index.htmlfile contains a large Base64-encoded string assigned to theencodedHtmlvariable. This string decodes to a full HTML document containing embedded JavaScript and CSS, effectively hiding executable code from static plain-text scanning. - [DYNAMIC_EXECUTION]: The loader script in
demo/index.htmldynamically decodes theencodedHtmlpayload and executes it by setting thesrcdocproperty of a sandboxed iframe. It also performs runtime string substitution for script sources, representing the dynamic assembly and execution of code. - [INDIRECT_PROMPT_INJECTION]: The skill's demo instructions in
demo/PROMPT.mddirect the agent to use external content fromneuform.aias a fidelity target. This creates an ingestion surface for untrusted external data that could be used to influence the agent's behavior or provide malicious instructions.
Recommendations
- AI detected serious security threats
Audit Metadata