baoyu-design

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references several external libraries from unpkg.com, including three.js, d3.js, react, react-dom, and @babel/standalone. These are all well-known technology services. Several references (e.g., in built-in-skills/3d-object.md and starter-components/chart-stage.js) include subresource integrity (SRI) hashes, which is a security best practice to ensure the downloaded code has not been tampered with.
  • [DYNAMIC_EXECUTION]: The script agents/build-preview.mjs uses the new Function constructor to load the Babel library and to execute design component scripts within a proxy-based sandbox. This approach is used to isolate component code and provide a safe environment for previewing interactive designs. Similarly, agents/compile-design-system.mjs uses Babel to transpile JSX and TypeScript code. These behaviors are standard for design tools that require runtime compilation and rendering of user-authored components.
  • [COMMAND_EXECUTION]: The skill includes Node.js CLI tools (agents/gen-pptx and agents/gen-video) that use the playwright library to automate a headless Chromium browser for capturing slides and rendering animations. The video generation tool also spawns ffmpeg as a subprocess to encode PNG frames into video files. These operations are required for the skill's primary functionality of exporting design artifacts to professional formats.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:51 AM