agency-grid-layout-minimal

{"verdict":"MEDIUM","summary":"The skill utilizes Base64 encoding to bundle its demo HTML and employs dynamic script execution to render it within a sandboxed environment. It also fetches assets and scripts from well-known third-party services.","categories":["EXTERNAL_DOWNLOADS","COMMAND_EXECUTION"],"detailed_analysis":"- [EXTERNAL_DOWNLOADS]: The skill's demo configuration in demo/source.json references external resources from well-known services, including scripts from Cloudflare (cdnjs), Tailwind CSS, and Iconify, as well as assets hosted on Supabase.\n- [COMMAND_EXECUTION]: The demo/index.html file implements a runtime loader that decodes Base64-encoded content and dynamically injects it into a sandboxed iframe using the srcdoc attribute. This mechanism executes code that is not present in plain text.\n- [OBFUSCATION]: The demo/index.html file contains a large Base64-encoded string (encodedHtml) that hides the actual HTML structure and several external font URLs from static analysis.","python_packages":[],"node_packages":[],"remote_code_patterns":["https://cdn.tailwindcss.com/ → script tag","https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.2/gsap.min.js → script tag","https://code.iconify.design/iconify-icon/1.0.7/iconify-icon.min.js → script tag","https://hoirqrkdgbmvpwutwuwj.supabase.co/storage/v1/object/public/assets/assets/0d868fef-f560-45ca-ab35-5dad4fc29059_3840w.webp → fetch"],"obfuscated_urls":[{"url":"https://fonts.gstatic.com","file_path":"demo/index.html","evidence":"PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtU2VjdXJpdHktUG9saWN5IiBjb250ZW50PSJkZWZhdWx0LXNyYyAnbm9uZSc7IGJhc2UtdXJpICdub25lJzsgY29ubmVjdC1zcmMgJ25vbmUnOyBmb250LXNyYyBkYXRhOiBodHRwczovL2ZvbnRzLmdzdGF0aWMuY29tOyBmb3JtLWFjdGlvbiAnbm9uZSc7IGZyYW1lLXNyYyAnbm9uZSc7IGltZy1zcmMgYmxvYjo7