design-mobile-apps
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches design resources and API specifications from
sleek.designandiconify.design, which are legitimate service endpoints for the skill's primary purpose. - [COMMAND_EXECUTION]: Uses standard shell commands like
curlto interact with the API. The instructions specifically warn against unsafe practices like piping JSON throughechodue to shell expansion risks. - [CREDENTIALS_UNSAFE]: Correctly identifies that
SLEEK_API_KEYshould be handled via environment variables and implements a secure OAUTH-like device flow to prevent the user from manually handling raw keys. - [DATA_EXFILTRATION]: Network communication is strictly limited to the official
https://sleek.designdomain and thehttps://api.iconify.designservice for icons. No sensitive local data is targeted for transmission. - [INDIRECT_PROMPT_INJECTION]: The skill processes external HTML and design instructions. It mitigates risks by instructing the agent to treat the HTML as a structural reference rather than an instruction source and provides clear guidelines for handling 'pinned versions' blocks.
Audit Metadata