gsap
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEOBFUSCATIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmluses Base64 encoding for theencodedHtmlvariable to bundle the demo's HTML and CSS content into a single file. This is a common packaging technique for portable web demos and the decoded content is benign UI logic. - [EXTERNAL_DOWNLOADS]: The skill references and loads runtime libraries (GSAP, Three.js, Iconify, and Tailwind CSS) from well-known services such as Cloudflare (cdnjs), Iconify, and Tailwind's CDN. These are established technology providers.
- [DYNAMIC_EXECUTION]: The demo environment in
demo/index.htmldynamically decodes the bundled content and executes it within a sandboxed iframe using thesrcdocattribute. This execution is scoped to the local demo content and does not process external, untrusted input.
Audit Metadata