design-agent-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Command Execution: The skill directs the agent to run various setup and configuration commands using the
uvtool. These commands, such asuv run design-agent sandbox buildanduv run design-agent config set, are necessary for the installation and testing of the Design Agent software. - External Downloads: The onboarding process involves
uv syncand Docker builds, which download software packages and container images from external registries. These are standard operations for modern development environments and are expected given the skill's purpose. - Credential Handling: The skill mentions several sensitive API keys (e.g., ANTHROPIC_API_KEY, OPENAI_API_KEY) but follows security best practices by instructing that they should be manually entered by the user or stored in a
.envfile, and specifically mandates that the agent never print these keys.
Audit Metadata