skeuomorphic-ui
Warn
Audited by Snyk on Aug 26, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). In demo/index.html, the sandboxed demo HTML is decoded and then executed (frame.srcdoc = source), and that runtime HTML reads free text from the DOM via document.querySelectorAll('.reveal-word-inner') and innerHTML, which can include outsider-authored content from user-provided/demo-supplied copy.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The demo's iframe/srcdoc loads external runtime scripts and font resources at runtime (e.g. https://cdn.tailwindcss.com/, https://cdnjs.cloudflare.com/ajax/libs/gsap/3.12.2/gsap.min.js, https://code.iconify.design/iconify-icon/1.0.7/iconify-icon.min.js and https://fonts.googleapis.com), which execute JavaScript in the demo and are listed as required runtime dependencies, so they constitute runtime external code execution.
Issues (2)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata