vtable-skill

This is a browser-based table demo that intentionally evaluates JavaScript supplied through its editor, so untrusted editor content can execute with the page's privileges; the import/export stripping does not sandbox it. It also inserts exception messages into `innerHTML`, creating an HTML injection risk if an attacker can control the error text. The page loads dependencies from unpkg[.]com without integrity attributes, but this fragment shows no data exfiltration or other clear malware behavior. Severity is moderate for deployments that expose the editor or template inputs to untrusted users; otherwise the execution is part of the demo's stated functionality.

This fragment implements an editable live-preview diagnostic page and contains no evident built-in data theft or destructive behavior. Its main security risk is intentional arbitrary JavaScript execution from editor content via new Function in the page context, plus unescaped HTML insertion of template and error values. Treat the editor code and template data as trusted only; untrusted input could execute scripts or access same-origin browser data. Severity is high when untrusted users can supply these values, otherwise the execution is a feature with a substantial trust-boundary risk.