design-md
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
update-templates.shscript facilitates the retrieval of the latest design templates by fetching thegetdesignpackage from the official npm registry. This is a standard procedure for maintaining data files from a public repository. - [COMMAND_EXECUTION]: The skill provides several bash scripts (
apply.sh,list.sh,update-templates.sh) to manage the template library. Theapply.shscript allows for the automated copying of design specifications into the user's project directory. - [DYNAMIC_EXECUTION]: The
apply.shscript uses a short Python command to safely parse metadata from themanifest.jsonfile for the purpose of providing brand descriptions to the user. - [INDIRECT_PROMPT_INJECTION]: The skill processes external markdown files which are eventually read by the AI agent to determine project styling. While this represents a potential attack surface if the upstream npm package were compromised, the risk is inherent to the skill's primary function of providing design instructions and is mitigated by the static nature of the provided tokens.
Audit Metadata