awesome-design-systems
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill manifest contains maintenance instructions that involve downloading data from an external repository and immediately executing local scripts to process it. * Evidence: curl and python3 commands found in SKILL.md under the Source & refresh section. * Risk: This represents a download-then-execute pattern from an unverified source.
- [INDIRECT_PROMPT_INJECTION]: The skill loads reference data generated from a third-party GitHub repository, creating a surface for indirect prompt injection where malicious entries in the source could be loaded into the agent's context. * Ingestion points: Files in the references directory including all-systems.md and notable-by-category.md. * Boundary markers: None identified. * Capability inventory: Instructions suggest shell and Python execution environments are available. * Sanitization: No data sanitization or validation logic is defined.
- [COMMAND_EXECUTION]: The inclusion of shell commands in the skill instructions presents a risk of arbitrary code execution if manipulated or executed automatically by the agent.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/alexpate/awesome-design-systems/master/README.md - DO NOT USE without thorough review
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
Audit Metadata