ui-ux-pro-max
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: No evidence of malicious behavior, data exfiltration, or obfuscated content was found. The skill logic is contained within bundled Python scripts that process static intelligence data stored in local CSV files.
- [EXTERNAL_DOWNLOADS]: The documentation references the installation of an external utility
uipro-clivia npm and suggests using system package managers (brew,apt,winget) to install Python. These are documented as standard setup requirements. - [COMMAND_EXECUTION]: The skill facilitates the execution of bundled Python scripts (
scripts/design_system.py,scripts/search.py) to query design patterns and persist generated design system files to the local project directory. - [PROMPT_INJECTION]: The script
scripts/design_system.pycontains a potential indirect prompt injection surface where user-supplied project and page names are used to construct file system paths for persisting data. While project names are slugified by replacing spaces with hyphens, there is no comprehensive sanitization against path-traversal characters. Ingestion point: query arguments insearch.py. Boundary markers: Absent. Capability inventory: Local file-writing. Sanitization: Basic slugification only.
Audit Metadata