ui-ux-pro-max
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in
SKILL.mddirect the agent to check for the Python runtime and execute the search script (python3 .claude/skills/ui-ux-pro-max/scripts/search.py) to query design data. - [PRIVILEGE_ESCALATION]:
SKILL.mdcontains setup instructions for various operating systems that involve administrative commands, specifically usingsudo apt install python3for Linux environments. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local CSV files (
data/*.csv) and instructs the AI to synthesize this information into its responses. While this is the intended functionality, it represents an attack surface where data content influences agent behavior. - Ingestion points: Data is read from multiple CSV files in the
data/directory byscripts/core.pyand passed to the agent. - Boundary markers: None explicitly used in the CSV parsing logic.
- Capability inventory: The skill executes local Python scripts via shell commands.
- Sanitization: The Python script performs basic tokenization and regex-based punctuation removal, but does not sanitize the content for downstream LLM processing.
- [EXTERNAL_DOWNLOADS]: The skill references several external resources from well-known and trusted sources:
- Fetches font pairing information and CSS imports from Google Fonts.
- Provides links to official documentation for React, Next.js, Svelte, Vue, Tailwind CSS, Apple Developer (SwiftUI), and other established framework registries.
Audit Metadata