baoyu-design
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external libraries from unpkg.com, including
three.js,d3.js,react,react-dom, and@babel/standalone. These are all well-known technology services. Several references (e.g., inbuilt-in-skills/3d-object.mdandstarter-components/chart-stage.js) include subresource integrity (SRI) hashes, which is a security best practice to ensure the downloaded code has not been tampered with. - [DYNAMIC_EXECUTION]: The script
agents/build-preview.mjsuses thenew Functionconstructor to load the Babel library and to execute design component scripts within a proxy-based sandbox. This approach is used to isolate component code and provide a safe environment for previewing interactive designs. Similarly,agents/compile-design-system.mjsuses Babel to transpile JSX and TypeScript code. These behaviors are standard for design tools that require runtime compilation and rendering of user-authored components. - [COMMAND_EXECUTION]: The skill includes Node.js CLI tools (
agents/gen-pptxandagents/gen-video) that use theplaywrightlibrary to automate a headless Chromium browser for capturing slides and rendering animations. The video generation tool also spawnsffmpegas a subprocess to encode PNG frames into video files. These operations are required for the skill's primary functionality of exporting design artifacts to professional formats.
Audit Metadata