solar-duotone-bold
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEOBFUSCATIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) which decodes to the HTML, CSS, and JavaScript content for the design demo. This is used as a packaging mechanism to load the preview into a sandboxediframeviasrcdoc. - [EXTERNAL_DOWNLOADS]: The skill references and downloads assets from trusted and well-known services, including Google Fonts (
fonts.googleapis.com), Fontshare (api.fontshare.com), Iconify (code.iconify.design), and Tailwind CSS (cdn.tailwindcss.com). - [DYNAMIC_EXECUTION]: The demo implementation utilizes
srcdoccombined withsandbox="allow-scripts"to dynamically execute the decoded HTML and JavaScript within a restrictediframeenvironment. This includes an asset-loading shim that processes messages from the parent window to inject local assets via Blob URLs.
Audit Metadata