split-layout-technical
Warn
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [OBFUSCATION]: The
demo/index.htmlfile contains a large Base64-encoded payload assigned to the variableencodedHtml. This string encodes the full HTML structure and embedded scripts for the skill's demo, effectively hiding them from basic text-based security scans. - [DYNAMIC_EXECUTION]: The demo application dynamically decodes the Base64 payload at runtime and injects it into a sandboxed iframe using the
srcdocattribute. It also manages assets by passing them as Base64 strings viapostMessageand converting them intoBlobURLs within the iframe context. - [REMOTE_CODE_EXECUTION]: The skill dynamically generates script tags and Content Security Policy (CSP) directives by interpolating external runtime URLs into the decoded HTML template at execution time.
- [EXTERNAL_DOWNLOADS]: The skill depends on external libraries and assets sourced from well-known services, including Cloudflare (GSAP and ScrollTrigger), Tailwind CSS, and Supabase storage.
Audit Metadata