technical-wireframe-info-layout
Fail
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The file
demo/index.htmlstores its entire functional structure as a Base64-encoded string in theencodedHtmlvariable. This code is decoded at runtime usingatob()and executed within an iframe via thesrcdocattribute, which is a common obfuscation method to hide malicious logic from static scanners. - [EXTERNAL_DOWNLOADS]: The skill demo metadata and configuration reference multiple external dependencies and assets hosted on third-party domains, such as
cdnjs.cloudflare.com,code.iconify.design, andhoirqrkdgbmvpwutwuwj.supabase.co. - [REMOTE_CODE_EXECUTION]: The implementation dynamically fetches binary data and uses
URL.createObjectURL()to generate local paths for assets at runtime, enabling the dynamic assembly and execution of content within the browser environment.
Recommendations
- AI detected serious security threats
Audit Metadata