ui-ux-pro-max
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute local Python scripts (
scripts/search.py) to search design guidelines and generate systems. - [COMMAND_EXECUTION]: A path traversal vulnerability exists in
scripts/design_system.py. Theproject_nameparameter (provided via the--project-nameCLI argument) is used to construct local filesystem paths (design-system/[project_name]/MASTER.md) without sanitizing directory traversal sequences like... This allow an agent, following malicious or crafted user input, to create directories and write markdown files to arbitrary locations on the host system relative to the current working directory.
Audit Metadata