awwwards-setup
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute remote packages using
npx -y awwwards-mcpandnpx -y -p awwwards-mcp awwwards-indexfor server registration and indexing. These are vendor-owned resources consistent with the skill's purpose. - [EXTERNAL_DOWNLOADS]: The onboarding process triggers downloads of several packages and binaries, including
playwright(which installs Chromium browser binaries, ~120 MB) andffmpeg-staticvia npm. These are standard dependencies for the mentioned web capture and analysis features. - [COMMAND_EXECUTION]: The skill executes system-level commands to register MCP servers (e.g.,
claude mcp add) and install global npm packages (npm install -g awwwards-mcp playwright ffmpeg-static). These actions are explicitly requested by the user during the setup process. - [DATA_EXPOSURE_EXFILTRATION]: The skill reads and writes configuration data to
~/.awwwards-mcp/preferences.json. This is limited to local user preferences (viewport, density, feature flags) and follows standard configuration practices.
Audit Metadata