design-brief
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is a catalogue stub that instructs the agent to download and install its primary logic from an external repository (
https://github.com/nexu-io/open-design) using thenpx skills addcommand. This source is not identified as a trusted organization or well-known service. - [COMMAND_EXECUTION]: The skill contains a decision tree that requires executing shell commands (
grep,[ -e ...]) to check the local environment and determine whether to proceed with a global or project-level installation. - [DYNAMIC_CONTEXT_INJECTION]: The skill explicitly references the
!commandsyntax (common in environments like Claude Code) to trigger the installation of external code directly from the chat interface, bypassing standard manual verification steps.
Audit Metadata