clean-minimal-beige-light-mode
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) that stores the full HTML content for the design demo. This is used as a packaging mechanism to deliver the demo within a sandboxed environment. - [DYNAMIC_EXECUTION]: The demo loader in
demo/index.htmlusessrcdocto dynamically generate a sandboxed iframe. It also usesatobandUint8Arrayto reconstruct binary assets (images, fonts) from Base64 strings passed viapostMessageat runtime. - [EXTERNAL_DOWNLOADS]: The skill references and fetches assets and runtime libraries from well-known services and CDNs, including Supabase, Tailwind CSS, GSAP (GreenSock), and Iconify. These are standard resources for web development and design demos.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions and prompts encourage the agent to process external product briefs to generate UI code. This represents a potential attack surface where malicious instructions in a brief could attempt to influence the agent's code generation, although this is a common characteristic of code-generating skills.
Audit Metadata