design-system-audit
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx --yes notugly, which automatically fetches and runs thenotuglypackage from the public npm registry. Using--yesbypasses the default confirmation prompt for installing new packages. - [REMOTE_CODE_EXECUTION]: By instructing the agent to run
npx notugly, the skill executes code from a remote source that is not a well-known or pre-approved service. The integrity and safety of this package cannot be verified through static analysis. - [COMMAND_EXECUTION]: The skill provides several shell command patterns that combine the external package with local files (e.g.,
tokens.json) and external URLs (e.g.,npx notugly onepager <url>). This combination allows a third-party tool access to the user's local file content and network capabilities.
Audit Metadata