Skills
Navigate
skills/boshi-xixixi/traeskill/UI/UX Intelligence Expert/Gen Agent Trust Hub

UI/UX Intelligence Expert

Warn

Audited by Gen Agent Trust Hub on Jul 3, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The SKILL.md file contains instructions for the agent to execute a Python script using a hardcoded absolute path (/Volumes/MacOS/个人项目/skills/GitHub/TraeSkill/.trae/Skills/ui-ux-pro-max/scripts/search.py). This path points to a specific developer's environment and establishes an insecure pattern of executing scripts from unverified absolute paths.
  • [COMMAND_EXECUTION]: The persist_design_system function in scripts/design_system.py is vulnerable to path traversal. It uses the project_name and page arguments to construct file paths without sanitizing traversal sequences (e.g., ../), allowing the script to write or overwrite files outside of the intended design-system/ directory if a malicious input is provided.
  • [COMMAND_EXECUTION]: The skill implementation involves creating local directories and writing multiple Markdown files to the disk. These file-system modification capabilities are provided without sufficient input validation or path restricted boundaries, presenting a risk of unauthorized file modification or data corruption.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 3, 2026, 01:51 PM
Security Audit — agent-trust-hub — UI/UX Intelligence Expert