container-lines
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The
demo/index.htmlfile stores the entire demo payload as a Base64-encoded string (encodedHtml). This obscures the HTML and JavaScript content from direct inspection. - [DYNAMIC_EXECUTION]: The demo employs dynamic execution techniques, decoding the Base64 payload and injecting it into a sandboxed iframe via the
srcdocattribute. It also dynamically generates Blob URLs for binary assets and scripts usingURL.createObjectURLto inject them into the sandboxed environment. - [EXTERNAL_DOWNLOADS]: The skill references and bundles assets and scripts from external sources. According to the
demo/source.jsonmanifest, these include resources originally sourced from Supabase storage and well-known CDNs such as Cloudflare (GSAP), Tailwind CSS, and Iconify. The demo wrapper script indemo/index.htmlfetches these bundled files locally and loads them into the execution environment at runtime.
Audit Metadata