ui-ux-pro-max
Warn
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of bundled Python scripts (
scripts/search.py,scripts/design_system.py,scripts/core.py) to function. While the current script content is not malicious, providing executable code within a skill increases the overall attack surface of the agent's environment. - [COMMAND_EXECUTION]: A Path Traversal vulnerability exists in the
persist_design_systemfunction inscripts/design_system.py. - The script uses the
project_nameandpagearguments (which can be derived from user input) to construct directory and file paths. - Sanitization only involves lowercasing and replacing spaces with dashes, which fails to remove traversal sequences (e.g.,
../) or prevent absolute path overrides. - An attacker could trick the agent into using a malicious project name to write markdown files (e.g.,
MASTER.md) to unauthorized locations on the system. - [EXTERNAL_DOWNLOADS]: The skill's data files reference external URLs for Google Fonts and official documentation for numerous web and mobile frameworks. These are verified as well-known and trusted services and do not contribute to security risks.
Audit Metadata