ui-ux-pro-max
Warn
Audited by Gen Agent Trust Hub on May 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation (README.md and SKILL.md) recommends installing the global npm package 'uipro-cli' for initialization and setup, which introduces an external dependency.
- [COMMAND_EXECUTION]: The design intelligence workflow relies on the AI agent executing shell commands to run Python scripts (
scripts/search.py). These commands incorporate user-provided keywords, project names, and page names as arguments. - [COMMAND_EXECUTION]: The persistence functionality in 'scripts/design_system.py' uses the user-controlled 'project_name' and 'page' arguments to construct filesystem paths for saving generated data. The logic fails to sanitize these inputs against directory traversal characters (e.g., '..'), potentially allowing the AI agent to create directories or write Markdown files to arbitrary locations in the filesystem where it has write permissions.
Audit Metadata