website-contact-form

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFE
Full Analysis
  • [OBFUSCATION]: The skill implements a mechanism to hide recipient email addresses from automated scrapers using Base64 encoding and string reversal in the HTML data-to attribute. The provided public/js/mail-form.js script decodes this at runtime using atob(). This is a documented functional security feature for the site owner rather than a malicious obfuscation attempt.
  • [COMMAND_EXECUTION]: The skill's instructions include standard development validation steps using npm run check and npm test. These are expected commands for verifying template integration and do not involve suspicious or unauthorized execution.
  • [SAFE]: The contact form implementation follows the principle of least privilege by operating entirely on the client side via the 'mailto:' protocol, avoiding the need for server-side processing or external data storage. It also adheres to best practices for Content Security Policy (CSP) by utilizing local script files instead of inline scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 06:30 PM