glass-dark-mode-clock
Fail
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: HIGHOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string assigned to the variableencodedHtml. This string decodes to a full HTML document including inline scripts and styling, effectively concealing the demo's implementation details from static analysis. - [DYNAMIC_EXECUTION]: The demo loader in
demo/index.htmldynamically decodes theencodedHtmlstring and injects it into an iframe'ssrcdocattribute. Furthermore, the decoded HTML contains a bootstrap script that usespostMessageto receive asset data, which it then converts intoBlobobjects andObjectURLsto dynamically update document attributes likesrcandstyleat runtime. - [EXTERNAL_DOWNLOADS]: The skill's demo environment fetches resources from well-known services. It loads font styles from Google Fonts (
fonts.googleapis.com) and Fontshare (api.fontshare.com). Additionally, thedemo/source.jsonmetadata indicates that runtime scripts were originally sourced from the Tailwind CSS CDN and Iconify design service.
Recommendations
- AI detected serious security threats
Audit Metadata