dither-laser-dark-mode
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFEOBFUSCATIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The file
demo/index.htmlcontains a large Base64-encoded string (encodedHtml) that stores the template for the design demonstration. - [EXTERNAL_DOWNLOADS]: The skill fetches runtime scripts and font assets from well-known services including Google, Cloudflare, and Tailwind's content delivery networks.
- [DYNAMIC_EXECUTION]: The demo loader dynamically decodes HTML content and renders it using a sandboxed iframe with the
srcdocattribute, restricted by a secure Content Security Policy. - [INDIRECT_PROMPT_INJECTION]: The design workflow allows for user-defined content to be reflected in generated UIs, creating a potential surface for indirect injection that is mitigated by the sandboxed preview environment.
Audit Metadata