gsap-scrolltrigger-storytelling
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEOBFUSCATIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) representing an HTML document. This is decoded at runtime to populate a sandboxed iframe. Analysis of the decoded content confirms it is a legitimate design demo containing GSAP animation logic and CSS styling, with no malicious code or commands detected. - [EXTERNAL_DOWNLOADS]: The skill's demo configuration (
demo/source.json) and the encoded HTML reference runtime libraries (GSAP, Tailwind CSS, Iconify) from well-known CDNs (Cloudflare, Tailwind, Iconify). It also references media assets hosted on Supabase, which is a common and trusted storage provider for such demos. - [SAFE]: The demo implementation follows high security standards by using a restrictive Content Security Policy (CSP) and an iframe with a
sandboxattribute (allow-scripts) andno-referrerpolicy to isolate the demo environment.
Audit Metadata