nimbalyst-skills
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install packages from a custom registry (
nimbalyst.com/skills) using thenpx skills addcommand. This introduces external code into the execution environment that is not subject to standard security verification. - [REMOTE_CODE_EXECUTION]: By directing the agent to use
npx, the skill triggers the download and immediate execution of scripts from a remote source. This pattern is used to run unverified code from an external vendor. - [COMMAND_EXECUTION]: The instructions require the agent to have shell access to check for existing skill installations in the user's home directory path
~/.design-agent-skills/and to execute installation commands. - [PROMPT_INJECTION]: The documentation includes instructions for the agent to use shell execution bypasses (such as the
!prefix in specific environments like Claude Code), which encourages the agent to perform actions outside of its standard constrained interface.
Audit Metadata