light-mode-paper-technical
Warn
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string stored in the variableencodedHtml. This string encodes the entire HTML document for the skill's demo, effectively masking the code from static analysis. - [DYNAMIC_EXECUTION]: The demo implementation in
demo/index.htmluses theatob()function to decode the Base64 content and then utilizessrcdocto dynamically inject and execute the resulting HTML and JavaScript within a sandboxed iframe at runtime. - [EXTERNAL_DOWNLOADS]: The skill fetches image assets and runtime scripts from external domains including Supabase (
hoirqrkdgbmvpwutwuwj.supabase.co), Google Fonts, and established CDNs for Tailwind CSS and Iconify. These operations are documented as safe as they target well-known infrastructure consistent with the skill's purpose.
Audit Metadata