design-md

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The update-templates.sh script facilitates the retrieval of the latest design templates by fetching the getdesign package from the official npm registry. This is a standard procedure for maintaining data files from a public repository.
  • [COMMAND_EXECUTION]: The skill provides several bash scripts (apply.sh, list.sh, update-templates.sh) to manage the template library. The apply.sh script allows for the automated copying of design specifications into the user's project directory.
  • [DYNAMIC_EXECUTION]: The apply.sh script uses a short Python command to safely parse metadata from the manifest.json file for the purpose of providing brand descriptions to the user.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external markdown files which are eventually read by the AI agent to determine project styling. While this represents a potential attack surface if the upstream npm package were compromised, the risk is inherent to the skill's primary function of providing design instructions and is mitigated by the static nature of the provided tokens.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 07:55 AM
Security Audit — agent-trust-hub — design-md