website-contact-form
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [OBFUSCATION]: The skill implements a mechanism to hide recipient email addresses from automated scrapers using Base64 encoding and string reversal in the HTML
data-toattribute. The providedpublic/js/mail-form.jsscript decodes this at runtime usingatob(). This is a documented functional security feature for the site owner rather than a malicious obfuscation attempt. - [COMMAND_EXECUTION]: The skill's instructions include standard development validation steps using
npm run checkandnpm test. These are expected commands for verifying template integration and do not involve suspicious or unauthorized execution. - [SAFE]: The contact form implementation follows the principle of least privilege by operating entirely on the client side via the 'mailto:' protocol, avoiding the need for server-side processing or external data storage. It also adheres to best practices for Content Security Policy (CSP) by utilizing local script files instead of inline scripts.
Audit Metadata