skills/zzci/skills/pma-design/Gen Agent Trust Hub

pma-design

Pass

Audited by Gen Agent Trust Hub on Sep 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONOBFUSCATIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches established libraries from trusted content delivery networks.
  • Dependencies including d3.js, three.js, and Leaflet are loaded from unpkg.com and jsdelivr.net using version pinning and integrity hashes.
  • These downloads are performed to support data visualization, 3D rendering, and mapping capabilities.
  • [DYNAMIC_EXECUTION]: Local automation scripts use dynamic evaluation to enable core prototyping functionality.
  • The build-preview.mjs script uses new Function to initialize the Babel compiler and to execute component logic within isolated preview 'cards'.
  • This usage is restricted to the intended purpose of the skill and is implemented with a proxy-based sandbox to improve isolation.
  • [OBFUSCATION]: The skill vendors minified production builds of major open-source libraries.
  • Scripts for React, ReactDOM, and Babel are included in the scripts/vendor/ directory to support offline operation. These are verified production distributions of the respective projects.
  • [COMMAND_EXECUTION]: The toolkit utilizes the local shell and Node.js for project management and previewing.
  • Commands are used for design system compilation, asset recording, and running a local development server via nsl serve.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 1, 2026, 09:33 PM
Security Audit — agent-trust-hub — pma-design