The Agent Skills Directory

[OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the variable encodedHtml. This string decodes to a complete HTML document including scripts and styles, effectively hiding the demo's source code from static analysis tools.
[DYNAMIC_EXECUTION]: The skill employs a dynamic asset injection mechanism in demo/index.html. It fetches binary data for images and videos, encodes them, and transmits them via postMessage to a sandboxed iframe. A bootstrap script inside the iframe (data-neuform-asset-bootstrap) then intercepts these messages and performs bulk DOM manipulation to replace src, poster, and srcset attributes across all elements at runtime.
[EXTERNAL_DOWNLOADS]: The demo implementation in demo/source.json and demo/index.html fetches resources from several well-known services. This includes runtime dependencies like GSAP, ScrollTrigger, and Iconify from Cloudflare's CDN, CSS utilities from Tailwind, and fonts from Google Fonts. Media assets are also retrieved from Supabase storage.
[COMMAND_EXECUTION]: No evidence of shell command execution, privilege escalation, or persistence mechanisms was found in the provided instructions or scripts.
[CREDENTIALS_UNSAFE]: The analyzed files do not contain hardcoded API keys, private tokens, or sensitive environment variables. Placeholders and project-specific identifiers are used appropriately.

gsap-scrolltrigger-storytelling