webgl-3d-object
Fail
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: HIGHOBFUSCATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) that encapsulates the full source code of a design demo, effectively hiding its scripts and structure from plain-text inspection. - [DYNAMIC_EXECUTION]: The demo loader in
demo/index.htmldecodes the obfuscated HTML string and dynamically injects it into an iframe using thesrcdocattribute to facilitate runtime execution. - [OBFUSCATION]: The sandboxed demo content contains logic to perform additional Base64 decoding (
atob) on asset data received through the postMessage API, representing a secondary layer of obfuscated data handling. - [INDIRECT_PROMPT_INJECTION]: The
initWebGL3DObjectfunction inSKILL.mdprocesses a configuration object; if an agent populates these fields using unsanitized data from external sources, it creates an attack surface for indirect instructions, though the execution context is limited to rendering parameters.
Recommendations
- AI detected serious security threats
Audit Metadata