skeuomorphic-ui

Warn

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [OBFUSCATION]: The file demo/index.html contains a large Base64-encoded string assigned to the encodedHtml variable. This technique hides the demonstration UI's source code, including its HTML structure and interaction logic, from plain-text inspection.
  • [DYNAMIC_EXECUTION]: The skill uses JavaScript in demo/index.html to decode the Base64-encoded HTML and inject it into the srcdoc attribute of an iframe for runtime execution. It also utilizes URL.createObjectURL to dynamically load binary asset data from Base64 strings passed through a messaging interface. Furthermore, it dynamically modifies the Content Security Policy (CSP) of the embedded frame by injecting script source URLs compiled at runtime.
  • [EXTERNAL_DOWNLOADS]: The demonstration references and loads external assets such as fonts and runtime libraries (GSAP, ScrollTrigger, Iconify) from well-known public CDNs and trusted technology providers.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 29, 2026, 04:26 PM