corner-diagonals
Warn
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded payload assigned to theencodedHtmlvariable. This payload decodes to a full HTML document including inline scripts, styles, and WebGL shader code.- [DYNAMIC_EXECUTION]: Thedemo/index.htmlscript uses a custom decoder to transform theencodedHtmlstring into a document that is then executed within an iframe via thesrcdocproperty. This involves runtime string manipulation to inject script paths into the resulting document.- [EXTERNAL_DOWNLOADS]: The skill downloads necessary UI runtime libraries such as GSAP, Three.js, and Iconify, along with fonts, from well-known content delivery networks including Cloudflare, Google, and Tailwind.
Audit Metadata