orange-clean-paper-saas
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The file demo/index.html includes a Base64-encoded string (encodedHtml) that stores the full HTML and logic for the design demo, which is a standard packaging pattern for these design skills.- [SAFE]: The demo logic in demo/index.html decodes the Base64 content and uses URL.createObjectURL to dynamically inject asset data into a sandboxed iframe with scripts enabled.- [EXTERNAL_DOWNLOADS]: The skill configuration in demo/source.json identifies dependencies on common UI libraries including Tailwind CSS, GSAP, and Iconify, which are mapped to well-known and trusted CDN sources.- [PROMPT_INJECTION]: The skill consumes external design layout references as instructions for design generation. Ingestion point: demo/PROMPT.md. Boundary markers: The reference is scoped as a visual target. Capability inventory: Generates HTML and JS. Sanitization: The demo environment uses a sandboxed iframe with a restrictive Content Security Policy (default-src 'none').
Audit Metadata