gooey-blob-system
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) used to package the complete HTML, CSS, and JavaScript for the design demo. Analysis of the decoded content shows it contains legitimate UI animation logic using GSAP and SVG filters. - [DYNAMIC_EXECUTION]: The demo implementation in
demo/index.htmlusessrcdocand thepostMessageAPI to dynamically inject and execute the bundled demo content within a sandboxed iframe. This is a common design pattern for isolating design references from the primary execution environment. - [EXTERNAL_DOWNLOADS]: The skill references and fetches runtime dependencies from well-known and reputable services, including Tailwind CSS, GSAP (via Cloudflare's CDN), and Iconify. These resources are standard tools for modern web development and animation.
- [EXTERNAL_DOWNLOADS]: The skill metadata in
demo/source.jsonidentifies external assets hosted on Supabase infrastructure, which is a well-known cloud service provider.
Audit Metadata