remember-design-system
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the package@memi-design/cli@2.7.9from the NPM registry. This package belongs to the skill author's organization and is used for generating design briefs and token reports from local source code. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by passing user-supplied task descriptions into the CLI tool via the
--intentflag. - Ingestion points: The user's interface task is interpolated into a shell command in
SKILL.md. - Boundary markers: Absent.
- Capability inventory: The skill executes shell commands via
npxand reads local files in the./srcdirectory. - Sanitization: None specified within the skill instructions; safety relies on the CLI tool's internal handling of the intent string.
Audit Metadata