light-mode-paper-technical
Fail
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string assigned to the variableencodedHtml. This string decodes to a complete HTML document including internal JavaScript logic, which prevents direct inspection of the demo's behavior. - [REMOTE_CODE_EXECUTION]: The skill implements a dynamic content loading mechanism in
demo/index.html. It decodes the Base64-encoded HTML string and injects it into an iframe using thesrcdocattribute. Additionally, it uses thepostMessageAPI to transfer asset data (also as Base64) from the parent window to the iframe, where the content is converted into Blobs and Object URLs for runtime execution. - [EXTERNAL_DOWNLOADS]: The skill fetches media assets from Supabase storage (
hoirqrkdgbmvpwutwuwj.supabase.co). It also references runtime dependencies from Google Fonts, Iconify, and Tailwind CSS. These resources are retrieved during the demo initialization process.
Recommendations
- AI detected serious security threats
Audit Metadata