brand-design-md
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is designed to download and execute the
getdesignpackage from the npm registry usingnpx getdesign@latest. Using the@latesttag means the skill always fetches the most recent version, which lacks version pinning and creates a dependency on an external registry. - [REMOTE_CODE_EXECUTION]: By invoking
npx getdesign@latest, the skill executes code downloaded from a remote repository at runtime. This execution happens without a prior integrity check or manual review of the package's contents. - [COMMAND_EXECUTION]: The skill uses shell commands (e.g.,
npx skills add,grep, and[ -f "$f" ]) to manage its own installation and detect its environment, which requires shell access and execution privileges.
Audit Metadata