nested-container-frames
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) that stores the full HTML and logic for a design demo. This is a common method for packaging self-contained previews. - [DYNAMIC_EXECUTION]: The skill uses
srcdocandatob()withindemo/index.htmlto instantiate the sandboxed demo environment from the encoded data. Additionally, it performs runtime compilation of WebGL shaders for the demo's background visual effects. - [EXTERNAL_DOWNLOADS]: The demo environment fetches runtime dependencies from established services, including Tailwind CSS, Iconify, and Google Fonts. It also references assets hosted on Supabase, which are consistent with the vendor's metadata.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions in
demo/PROMPT.mdreference an external URL (neuform.ai) as a fidelity target for the AI's design output. While this creates a dependency on external content, it is part of the intended primary function for design referencing.
Audit Metadata