Indeed, this is weird. I guess the XSS-api validates that this is an xss-issue.I raised this Sling issue to who is right https://issues.apache.org/jira/browse/SLING-6490
Specify @ context='styleString' in your component.For style attributes you need to see this manually.More info here: https://docs.adobe.com/docs/en/htl/docs/expression-language.html
AFAIK you can only share assets with the creative cloud.See here the link: https://docs.adobe.com/docs/en/aem/6-2/administer/integration/configure-assets-cc-integration.html