design-lab
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration and instructions direct the agent to fetch a full skill implementation from a remote GitHub repository (0xdesign/design-plugin). This source is not associated with a known trusted vendor.
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run the npx skills add 0xdesign/design-plugin command. This process involves downloading and executing third-party scripts at runtime from an unverified external source.
- [COMMAND_EXECUTION]: The skill requires the agent to perform file system checks (searching for existing installations in ~/.design-agent-skills/) and shell command execution (running the npx installer). It also explicitly suggests using the ! prefix for shell execution within the Claude Code environment.
Audit Metadata