background-grid-webgl

Warn

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string in the encodedHtml variable. This string decodes to a complete HTML document, effectively hiding the implementation details of the demo from static analysis.
  • [DYNAMIC_EXECUTION]: The skill utilizes WebGL, which involves the runtime compilation of vertex and fragment shaders from string templates. Additionally, the demo script uses atob and URL.createObjectURL to dynamically convert and load assets provided as Base64 data.
  • [EXTERNAL_DOWNLOADS]: The demo fetches runtime dependencies from several well-known services. These include scripts from Tailwind CSS and Iconify, as well as fonts from Google Fonts. It also references image assets stored on Supabase infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process natural language prompts to generate specific WebGL parameters and styles. This creates a surface where external instructions could influence the agent's code generation.
  • Ingestion points: User prompts defined in demo/PROMPT.md and runtime user input.
  • Boundary markers: The skill uses specific sections like 'Visual target', 'Implementation guidance', and 'Avoid' to constrain the agent's behavior.
  • Capability inventory: The skill possesses the ability to generate and execute WebGL shaders and manipulate the DOM in the resulting HTML output.
  • Sanitization: There is no explicit sanitization or validation logic defined in the skill to filter instructions embedded within the user-provided descriptions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 21, 2026, 01:29 AM
Security Audit — agent-trust-hub — background-grid-webgl