ux-writing-skill
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and install code from an external GitHub repository (
content-designer/ux-writing-skill). - Evidence:
npx skills add content-designer/ux-writing-skill --skill ux-writing-skill -g -yinSKILL.md. - [COMMAND_EXECUTION]: The skill contains bash commands used for environment detection and software installation.
- Evidence:
grep -q "^das:" ~/.agents/skills/ux-writing-skill/SKILL.mdand[ -e ~/.agents/skills/ux-writing-skill ]inSKILL.md. - [PROMPT_INJECTION]: The skill processes user-provided interface copy which represents a data ingestion surface. While no immediate dangerous execution is chained to this input, it remains a surface for indirect prompt injection.
- Ingestion points: User-provided microcopy, error messages, and UI text labels.
- Boundary markers: None detected in the provided skill text.
- Capability inventory: Shell execution (
npx,grep) via the!command syntax. - Sanitization: No explicit sanitization or filtering of input text is documented.
Audit Metadata