frontend-design-ultimate
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts (init-vite.sh, init-nextjs.sh, and bundle-artifact.sh) to automate project initialization and build tasks. These scripts perform routine operations such as directory creation, file writing, and dependency installation using standard bash commands.
- [EXTERNAL_DOWNLOADS]: The skill fetches frontend development dependencies (e.g., Next.js, Vite, Tailwind CSS, and shadcn/ui components) from the official npm registry. These downloads are performed through standard CLI tools and are consistent with modern development workflows.
- [PROMPT_INJECTION]: The skill is designed to translate user-provided text requirements into code outputs. (1) Ingestion points: User instructions provided in the prompt context. (2) Boundary markers: Absent in the instructions. (3) Capability inventory: Subprocess calls in project initialization scripts to execute npm and npx commands. (4) Sanitization: Input project names are quoted in the shell scripts to prevent command injection. This behavior is expected and safe for the skill's purpose.
Audit Metadata