extract-design-system
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of a package from an untrusted third-party GitHub repository (arvindrk/extract-design-system) via the npx command. This introduces a supply chain risk as the source code is not provided by a verified or trusted organization.
- [COMMAND_EXECUTION]: The skill facilitates the execution of external tools through 'npx skills add', which pulls and integrates external logic into the agent environment. This could lead to arbitrary code execution if the upstream package is compromised.
- [PROMPT_INJECTION]: The skill ingests untrusted data from external websites to reverse-engineer design tokens, which serves as a surface for indirect prompt injection.
- Ingestion points: Website URLs (CSS and HTML content) provided by the user.
- Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present in the skill definition.
- Capability inventory: The skill possesses the capability to install external packages, perform network scraping, and generate local files (tokens.json, tokens.css).
- Sanitization: There is no evidence of sanitization or validation of the content scraped from external sources.
Audit Metadata