import
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx @subframe/cli@latestto download and execute the vendor's official command-line interface. This is a standard deployment pattern for the SubframeApp vendor resources. - [COMMAND_EXECUTION]: The skill executes local shell commands to create directories (
mkdir) and run the Subframe CLI (npx). These operations are constrained to the skill's documented purpose of managing the design system manifest and performing the upload. - [CREDENTIALS_SAFE]: Authentication is handled via specific MCP tools (
list_projects,generate_auth_token) or through a secure web-based fallback. This avoids manual handling or exposure of long-lived secrets within the agent's prompts.
Audit Metadata