beautiful-shadows
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a Base64-encoded string representing the full source of the design demo. This is a standard method for bundling self-contained HTML previews within a single file. Decoding reveals legitimate code for UI components and WebGL animations. - [DYNAMIC_EXECUTION]: The demo preview mechanism uses
srcdocwithin an<iframe>element to render the bundled HTML. This execution is properly isolated using thesandbox="allow-scripts"attribute and a highly restrictive Content Security Policy (CSP). - [UNVERIFIABLE_DEPENDENCIES]: The skill fetches runtime libraries (GSAP, Three.js, Iconify, Tailwind) from well-known and trusted Content Delivery Networks (CDNs) including Cloudflare (cdnjs.cloudflare.com) and Tailwind Labs (cdn.tailwindcss.com). These resources are used for the demo's interactive elements and are considered safe.
Audit Metadata