mesh-gradient-dark-blue-clean
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string assigned to the variableencodedHtml. Upon decoding, this string reveals the legitimate HTML source code for the 'Alert Interface' design demo. This is used for self-contained bundling of the design example. - [DYNAMIC_EXECUTION]: The skill implements a sandboxed rendering mechanism in
demo/index.html. It utilizes aniframewith asrcdocattribute to inject the decoded HTML and communicates viapostMessageto load assets. The iframe is properly restricted withsandbox="allow-scripts"and a highly restrictive Content Security Policy (CSP) that blocks all external network connections by default. - [EXTERNAL_DOWNLOADS]: The skill and its demo reference well-known and trusted services for UI assets. It fetches typography from Google Fonts (
fonts.googleapis.com) and uses runtime scripts originally sourced from the Tailwind CSS CDN and Iconify, which are standard utilities in web development.
Audit Metadata