compose-design-catalog
Fail
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions include a command to download and execute a shell script from the author's GitHub repository using
curl -fsSL https://raw.githubusercontent.com/yschimke/skills/main/scripts/install.sh | bash. This pattern is considered high-risk as it executes remote code without prior review. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute tools and references scripts located in external repositories for validation and generation tasks. - [COMMAND_EXECUTION]: The workflow involves executing various command-line tools including
node,git,gradlew, andcompose-previewto process code and generate artifacts. - [DYNAMIC_EXECUTION]: The skill runs local JavaScript files and utilizes
npxfor runtime tool execution. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection due to its processing of untrusted project data. 1. Ingestion points: Reads Kotlin source files (
.kt) and a user-providedcatalog.spec.jsonfile. 2. Boundary markers: No explicit instructions or mechanisms are provided to isolate untrusted data. 3. Capability inventory: The skill can execute shell commands and perform file operations. 4. Sanitization: There is no evidence of sanitization for the content of the source files being analyzed.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/yschimke/skills/main/scripts/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata