marquee-loop
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMOBFUSCATIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string in theencodedHtmlvariable that decodes to a full HTML document. This technique obfuscates functional code, including structure and inline scripts, from static text-based security analysis. - [EXTERNAL_DOWNLOADS]: The skill fetches dependencies and assets from external services. As documented in
demo/source.json, these include runtime scripts from the Cloudflare CDN (GSAP, ScrollTrigger) and Iconify, as well as images hosted on Supabase storage. These are well-known and established service providers. - [DYNAMIC_EXECUTION]: The demo loader in
demo/index.htmlusesURL.createObjectURLto dynamically generate Blob URLs for asset data at runtime. This allows binary data to be injected into the sandboxed document environment programmatically.
Audit Metadata