awwwards-doctor
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands for diagnostics and maintenance, including
npm run doctor,npm run build, andnpx playwright install chromium. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading external resources, specifically browser binaries via Playwright and package updates using
npm install -g awwwards-mcp@latest. - [DYNAMIC_EXECUTION]: The skill supports self-modification and runtime updates:
- It encourages the agent to modify its own source code (
src/parsers.ts) and update fixtures to fix 'parser drift'. - It identifies the environment variable
AWWWARDS_AUTO_UPDATE=1which enables a background self-update mechanism on startup. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from an external source (awwwards.com) and possesses the following security profile:
- Ingestion points: Reads live web markup and JSON blobs from awwwards.com to diagnose and fix parsers.
- Boundary markers: None identified in the provided instructions; the agent is encouraged to directly search and incorporate findings into source code.
- Capability inventory: The skill has access to shell execution (
npm), file system writes (modifyingsrc/,test/, andscripts/), and network operations (fetching live pages). - Sanitization: No explicit sanitization or validation of the ingested markup is described before the agent uses it to re-anchor parsers.
Audit Metadata