high-contrast-skeuomorphic-clean
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a Base64-encoded HTML document within theencodedHtmlvariable. This implementation choice hides the demo structural code and inline scripts from initial inspection. - [DYNAMIC_EXECUTION]: The demo implementation uses
iframe.srcdocto dynamically render the decodedencodedHtmlcontent. This content includes an inline script that programmatically modifies the DOM and styles based on messages received from the parent window. - [EXTERNAL_DOWNLOADS]: The skill demo references external resources from reputable services including Google Fonts, Cloudflare (GSAP), and Iconify. These references are used for fonts, animations, and icons.
- [INDIRECT_PROMPT_INJECTION]: The design demo uses a message-passing system to inject assets into the sandboxed frame. The script inside the frame performs string-based replacements on DOM attributes and CSS content using data received via
postMessage, which creates a theoretical surface for injection if the input assets are not strictly validated.
Audit Metadata