frontend-lp
Warn
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements PostToolUse hooks that automatically execute bash scripts (~/.claude/hooks/ts-check.sh, ~/.claude/hooks/auto-prettier.sh, and ~/.claude/hooks/console-log-check.sh) whenever TypeScript or JavaScript files are edited.
- [REMOTE_CODE_EXECUTION]: The workflow instructs the use of pnpm dlx to download and install UI components directly from remote URLs at magicui.design.
- [EXTERNAL_DOWNLOADS]: The skill utilizes MCP tools and web searches to fetch external documentation and package information from the npm registry and other online sources.
- [PROMPT_INJECTION]: The skill ingests untrusted data from npm documentation and web searches without using explicit sanitization or boundary markers. Ingestion points: mcp__expo-mcp__fetch_npm_docs, web search. Boundary markers: Absent. Capability inventory: pnpm install, bash hooks, pnpm dlx. Sanitization: Absent.
Audit Metadata