material-3-skill
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of its full implementation from a remote third-party GitHub repository (
github.com/hamen/material-3-skill).- [COMMAND_EXECUTION]: The skill provides several shell commands and logic (usingnpx,grep, andecho) for the agent to execute in order to manage installation and verify the state of the local file system.- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to install and execute code from an unverified community repository using thenpx skillscommand. The command uses a-yflag which bypasses user confirmation prompts during installation.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process Material Design tokens, Jetpack Compose code snippets, and UI layout definitions, which represents an attack surface for indirect instruction injection. - Ingestion points: Material Design 3 tokens and UI component definitions mentioned in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the installation stub.
- Capability inventory: Includes shell execution, file system reads, and network operations via the installation CLI.
- Sanitization: No sanitization or validation logic is defined for the content fetched from the remote repository.
Audit Metadata