blur
Warn
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The file
assets/blur.jsimports a utility script from a personal CodePen account (https://codepen.io/soju22/pen/cb31020fed766eb66bc8ad1879bc3325.js). This represents a dependency on unverified external code that could be modified or removed without the skill author's control. - [REMOTE_CODE_EXECUTION]: The imported script from CodePen is executed in the browser context at runtime. While the
SKILL.mdidentifies this as a known risk under the 'Technical Debt' section and advises 'vendorizing' the code for production, the current configuration remains a security concern for non-prototype environments. - [EXTERNAL_DOWNLOADS]: The skill loads the Three.js library from
unpkg.com(https://unpkg.com/three@0.120.0/build/three.module.js). This is a well-known service for serving public packages and is documented as a project dependency.
Audit Metadata