glass-dark-mode-clock

Fail

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: HIGHOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the variable encodedHtml. This string decodes to a full HTML document including inline scripts and styling, effectively concealing the demo's implementation details from static analysis.
  • [DYNAMIC_EXECUTION]: The demo loader in demo/index.html dynamically decodes the encodedHtml string and injects it into an iframe's srcdoc attribute. Furthermore, the decoded HTML contains a bootstrap script that uses postMessage to receive asset data, which it then converts into Blob objects and ObjectURLs to dynamically update document attributes like src and style at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill's demo environment fetches resources from well-known services. It loads font styles from Google Fonts (fonts.googleapis.com) and Fontshare (api.fontshare.com). Additionally, the demo/source.json metadata indicates that runtime scripts were originally sourced from the Tailwind CSS CDN and Iconify design service.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 14, 2026, 02:33 PM