design-review

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/setup-capture.mjs script manages the installation of standard development dependencies including playwright, @axe-core/playwright, pixelmatch, and pngjs via the npm package manager. It also automates the download of the Chromium browser binary required for visual auditing. These libraries are well-known and trusted in the development community for testing and image processing.
  • [COMMAND_EXECUTION]: The skill uses Node.js and Python scripts to execute shell commands for environment setup and design review tasks. This includes executing npm install, npx playwright install, and launching headless browser instances via Playwright to analyze live web routes and capture screenshots for visual evidence.
  • [DATA_EXFILTRATION]: Static analysis scripts (accessibility-check.py, anti-pattern-check.py, and state-check.py) include a ping_telemetry function that performs a network request using urllib.request.urlopen. This function is only activated if the ADS_TELEMETRY_URL environment variable is defined and only transmits the name of the script being executed to track skill usage. It does not exfiltrate sensitive user data or local files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 09:18 AM