Skills
Navigate
skills/yray/skills/clean-minimal-beige-light-mode/Gen Agent Trust Hub

clean-minimal-beige-light-mode

Warn

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [OBFUSCATION]: The file demo/index.html contains a large Base64-encoded payload in the encodedHtml variable, which stores the complete source code for the design demo.- [DYNAMIC_EXECUTION]: The skill uses JavaScript to decode the Base64 payload and inject it into an iframe via the srcdoc property at runtime. It also uses URL.createObjectURL to dynamically load binary assets like WebP and JPG files.- [EXTERNAL_DOWNLOADS]: The skill references and downloads runtime dependencies from well-known services, including GSAP and ScrollTrigger from Cloudflare's CDN, Iconify icons, and Tailwind CSS from their respective official CDNs.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided product briefs to generate HTML documents, creating an ingestion surface where untrusted data could influence the generated output and its execution environment.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 25, 2026, 03:09 AM
Security Audit — agent-trust-hub — clean-minimal-beige-light-mode