ui-craft
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill metadata and instructions direct the agent to install code from an external GitHub repository (
github.com/educlopez/ui-craft). This repository belongs to an unverified third-party user, and the installation involves downloading unpinned code (version: latest). - [COMMAND_EXECUTION]: The documentation explicitly suggests using the
!commandsyntax (specifically! npx skills add ...) to trigger shell execution. In certain agent environments, this prefix allows for immediate command execution without further confirmation, which can be exploited if the source or arguments are compromised. - [REMOTE_CODE_EXECUTION]: The skill encourages the installation and invocation of a remote package from an untrusted source. This established workflow allows arbitrary code from a remote repository to be executed within the local environment.
Audit Metadata