skeuomorphic-ui
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string assigned to theencodedHtmlvariable. This technique hides the demonstration UI's source code, including its HTML structure and interaction logic, from plain-text inspection. - [DYNAMIC_EXECUTION]: The skill uses JavaScript in
demo/index.htmlto decode the Base64-encoded HTML and inject it into thesrcdocattribute of an iframe for runtime execution. It also utilizesURL.createObjectURLto dynamically load binary asset data from Base64 strings passed through a messaging interface. Furthermore, it dynamically modifies the Content Security Policy (CSP) of the embedded frame by injecting script source URLs compiled at runtime. - [EXTERNAL_DOWNLOADS]: The demonstration references and loads external assets such as fonts and runtime libraries (GSAP, ScrollTrigger, Iconify) from well-known public CDNs and trusted technology providers.
Audit Metadata