designer-skills-collection
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation instructs users to download and install a suite of 91 skills and 28 commands from a remote repository at
https://github.com/Owl-Listener/designer-skills. This repository is not associated with a pre-verified or trusted organization. - [COMMAND_EXECUTION]: The skill provides explicit shell commands for users to execute, including adding a third-party marketplace (
/plugin marketplace add Owl-Listener/designer-skills), cloning the repository (git clone), and copying files into local or global extension directories (cp -r ...). - [INDIRECT_PROMPT_INJECTION]: The skill suite is designed to process external data sources such as user research data, competitive benchmarks, and interview transcripts. This represents an attack surface where malicious instructions could be embedded in the data being synthesized or audited by the agent.
- Ingestion points: The described plugins (e.g.,
design-research,ux-strategy) are designed to ingest and process research data, interview notes, and competitive analysis materials. - Boundary markers: None are specified in the provided documentation to differentiate between instructions and the data being analyzed.
- Capability inventory: The plugins include high-impact capabilities such as creating file specifications, auditing systems, and generating developer handoff packages.
- Sanitization: There are no documented mechanisms for sanitizing or validating the integrity of the external data processed by these tools.
Audit Metadata