awwwards-doctor

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands for diagnostics and maintenance, including npm run doctor, npm run build, and npx playwright install chromium.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates downloading external resources, specifically browser binaries via Playwright and package updates using npm install -g awwwards-mcp@latest.
  • [DYNAMIC_EXECUTION]: The skill supports self-modification and runtime updates:
  • It encourages the agent to modify its own source code (src/parsers.ts) and update fixtures to fix 'parser drift'.
  • It identifies the environment variable AWWWARDS_AUTO_UPDATE=1 which enables a background self-update mechanism on startup.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from an external source (awwwards.com) and possesses the following security profile:
  • Ingestion points: Reads live web markup and JSON blobs from awwwards.com to diagnose and fix parsers.
  • Boundary markers: None identified in the provided instructions; the agent is encouraged to directly search and incorporate findings into source code.
  • Capability inventory: The skill has access to shell execution (npm), file system writes (modifying src/, test/, and scripts/), and network operations (fetching live pages).
  • Sanitization: No explicit sanitization or validation of the ingested markup is described before the agent uses it to re-anchor parsers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 11:22 AM