open-design-homepage
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Draco mesh decoder from Google's official gstatic domain at runtime, which is standard behavior for Three.js applications using compressed 3D geometry.
- [SAFE]: Static analysis flags for homoglyphs and Base64 decoding were manually reviewed and found to be benign:
- The homoglyph URL (
https://тест) is a unit test case within the included core-js polyfill library used to verify IDNA domain handling. - The Base64 decoding (
atob) is part of the standard Next.js React Server Components (RSC) runtime for processing data payloads. - [SAFE]: All JavaScript chunks are identified as standard Next.js/Turbopack production build artifacts. The author context ('nexu-io') matches the domains and repositories referenced in the manifest.
Audit Metadata