@1892/starchild-design-pack
Warn
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Potential path traversal vulnerability in the file persistence logic.
- The
persist_design_systemfunction inscripts/design_system.pyuses theproject_nameparameter to construct a directory path without sanitizing directory traversal characters (e.g.,../). - This allows the script to create directories and write markdown files outside the intended
design-system/folder if a malicious project name is provided. - This logic is reachable via the CLI tool in
scripts/search.pywhen using the--persistflag. - [EXTERNAL_DOWNLOADS]: Reference to external guidelines from a trusted source.
- The file
references/web-interface-guidelines-source.mdpoints to an official Vercel Labs repository for fetching rules. - This reference targets a well-known and trusted organization and is documented neutrally without escalating the verdict.
Audit Metadata