antfu-design
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to install necessary development dependencies. Evidence includes
pnpm add @antfu/design unocssinreferences/core-setup.mdand multiplepnpm addcommands for Storybook integration inreferences/storybook.md. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the vendor's design package (
@antfu/design) and several well-known third-party libraries (such asunocss,storybook, andvue) from the official NPM registry. - [PROMPT_INJECTION]: The skill contains a mechanism to persist design rules into the project's agent configuration, potentially influencing future behavior (Multi-step chain). Ingestion point: The project's
AGENTS.mdfile. Boundary markers: No delimiters or ignore instructions are used when appending the rule. Capability inventory: The skill leverages the agent's file-modification capabilities to persist instructions. Sanitization: No validation or sanitization is performed on the appended content.
Audit Metadata