open-codesign-ai-design
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute a shell script from a remote service (Ollama) by piping it directly into a shell interpreter. While the source is a well-known service for local models, this method bypasses standard package verification.\n- [PRIVILEGE_ESCALATION]: Instructs users to execute
xattr -cron the application bundle to remove the macOS quarantine attribute. This allows the execution of un-notarized software, effectively bypassing Gatekeeper security protections.\n- [COMMAND_EXECUTION]: The skill requires manual execution of shell commands for application setup, clearing system caches, and verifying disk resources, which could lead to unintended system modifications if misused.\n- [INDIRECT_PROMPT_INJECTION]: The skill serves as a surface for indirect prompt injection as it processes natural language prompts and local workspace documents (like DESIGN.md) to generate code and design prototypes.\n - Ingestion points: Processes natural language user prompts and configuration files from the local workspace.\n
- Boundary markers: Does not include specific delimiters or instructions to ignore embedded malicious content within the design inputs.\n
- Capability inventory: The tool creates interactive HTML/JS artifacts, accesses local workspace files, and integrates with multiple third-party AI provider APIs.\n
- Sanitization: No evidence of input sanitization or validation for the data ingested by the agent is provided.
Recommendations
- HIGH: Downloads and executes remote code from: https://ollama.com/install.sh - DO NOT USE without thorough review
Audit Metadata