aipixelperfect-design-generator
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires downloading project files from a personal GitHub account (
abnormal-codex) that is not recognized as a trusted organization or well-known service vendor. - Evidence:
git clone https://github.com/abnormal-codex/Ai-Pixel-Design-Archive.git - [COMMAND_EXECUTION]: The installation steps involve executing shell commands that perform network downloads and package management operations on code of unverified integrity.
- Evidence:
git clone,npm install - [REMOTE_CODE_EXECUTION]: Executing
npm installon an untrusted repository allows for the potential execution of arbitrary code via package lifecycle scripts (e.g., preinstall, postinstall) which could lead to host system compromise. - [INDIRECT_PROMPT_INJECTION]: The skill takes untrusted user input via design prompts and sends them directly to an external API endpoint (
https://abnormal-codex.github.io/Ai-Pixel-Design-Archive/api), creating a vulnerability surface where malicious instructions could be processed by the backend engine.
Recommendations
- AI detected serious security threats
Audit Metadata