api-designer
Fail
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill metadata and documentation sections contain the URL
https://jeffallan.github.io/claude-skills/skills/api-architecture/api-designer/, which has been flagged as malicious by automated security scanners. Referencing malicious domains poses a risk of phishing or drive-by downloads for users who access the documentation. - [COMMAND_EXECUTION]: The workflow instructs the agent and user to execute shell commands using
npxfor linting and mocking API specifications:npx @redocly/cli lint openapi.yamlandnpx @stoplight/prism-cli mock openapi.yaml. - [REMOTE_CODE_EXECUTION]: By utilizing
npxto run CLI tools, the skill triggers the dynamic download and execution of packages directly from the npm registry. This introduces a runtime dependency on external code that is not version-pinned or audited within the skill's own file structure.
Recommendations
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata