dither-laser-dark-mode
Warn
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) which decodes to the complete HTML, CSS, and JavaScript source for the design demo. This technique hides implementation details from plain-text scanning. - [DYNAMIC_EXECUTION]: The skill employs a dynamic content delivery method where the decoded HTML is injected into a sandboxed iframe via the
srcdocattribute. Additionally, the demo script dynamically converts Base64-encoded media assets intoBlobURLs and updates the DOM at runtime. While these methods provide isolation, they constitute runtime code and content assembly. - [SAFE]: The demo environment is configured with security best practices, utilizing a sandboxed iframe (
sandbox="allow-scripts") and a restrictive Content Security Policy (CSP) to limit the execution environment and prevent unauthorized network connections.
Audit Metadata