autodesign

SUSPICIOUS: the core design automation purpose is coherent, and the referenced CLIs are mostly official, but the skill materially expands trust through transitive skill dependencies and enables unattended deploy/commit/push loops. The biggest risks are transitive instruction loading, AFK real-world actions, and exporting screenshots/project context to external model tooling.

No explicit malware behaviors (e.g., credential theft, reverse shells, destructive actions, direct network exfiltration code) are present in this snippet itself. However, the main supply-chain/security concern is operational: it repeatedly invokes a high-capability external LLM CLI with `--dangerously-skip-permissions` and persists full model output to disk, while also letting untrusted model output drive control-flow termination (COMPLETE/BLOCKED/DECIDE). If the runner’s permissions are broad or logs/prompt/state contain sensitive data, the impact of prompt injection or unintended agent actions could be significant. Review the invoked `claude` runner behavior, the environment/permissions it inherits, and how PROMPT_FILE/build_prompt and state content handle secrets.