css-border-gradient
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file demo/index.html includes a Base64-encoded string (encodedHtml) that contains the full HTML structure of the design demo. Decoding reveals standard web content for a florist site with scripts for animations and asset handling. This is a common bundling practice for self-contained demos and does not hide malicious code.
- [DYNAMIC_EXECUTION]: The demo loader in demo/index.html dynamically decodes and injects the demo content into a sandboxed iframe using the srcdoc attribute. It also utilizes URL.createObjectURL to serve local assets. These operations are performed within a restricted environment protected by a strict Content Security Policy (CSP) and iframe sandboxing.
- [EXTERNAL_DOWNLOADS]: The skill's metadata in demo/source.json references external resources from well-known technology providers, including Google Fonts, Cloudflare (cdnjs), and Supabase. These connections are standard for web development and do not represent a security risk.
Audit Metadata