claude-design-studio-ui-generator
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to clone a repository from an untrusted GitHub account (larajuniorlara/Claude-Design-Studio) and perform dependency installation.
- [DYNAMIC_EXECUTION]: The skill implements a marketplace-style plugin and skill system that allows for the dynamic installation and execution of external code modules at runtime.
- [INDIRECT_PROMPT_INJECTION]: The system processes raw API code, JSON data, and natural language descriptions to generate UI, which creates a significant attack surface where malicious input could influence the agent's behavior.
- [COMMAND_EXECUTION]: The skill relies on shell commands including git clone, npm install, and various npx-based utility calls for its core functionality.
- [METADATA_POISONING]: The skill requests global tool access using
allowed-tools: ["*"], which is a potential indicator of autonomy abuse and over-privileged behavior.
Audit Metadata