high-contrast-skeuomorphic-clean
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded HTML string used for bundling the visual preview of the design system. - The encoded content decodes to a standard HTML document containing structure, styles, and scripts relevant to the design demo.
- The use of Base64 in this context is for self-contained packaging of the demo assets and does not hide malicious code.
- [DYNAMIC_EXECUTION]: The demo environment utilizes
srcdocto dynamically render the bundled HTML within an iframe. - The iframe is protected with
sandbox="allow-scripts"to isolate the demo from the parent context while allowing design-related animations. - A script within the iframe dynamically processes design assets received from the parent window via
postMessage, converting them into Object URLs for display. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill references several external resources and runtime libraries through the
demo/source.jsonmetadata. - Runtime dependencies (such as GSAP, Iconify, and Tailwind CSS) are sourced from well-known Content Delivery Networks (CDNs) like Cloudflare and Tailwind's official infrastructure.
- Fonts are requested from Google's official font services.
- Design assets are hosted on Supabase, a well-known backend provider.
- All external references target established technology services and organizations.
Audit Metadata