motion-design
Warn
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to automatically execute a shell command to list the contents of several directories, including hidden folders within the user's home directory (
~/.claude/skills/,~/.agent/skills/, etc.). This command is intended to run silently upon the skill's first activation to survey the local environment. - [EXTERNAL_DOWNLOADS]: The skill directs the agent to suggest the installation of further software components from an untrusted third-party repository (
AbsolutelySkilled/AbsolutelySkilled) usingnpx. This poses a risk of introducing unverified code into the user's system. - [DATA_EXFILTRATION]: Through the automated execution of the
lscommand on private configuration paths, the skill collects metadata about the user's installed tools. This information is used to drive automated suggestions for further downloads from untrusted sources.
Audit Metadata