pma-design
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONOBFUSCATIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches established libraries from trusted content delivery networks.
- Dependencies including d3.js, three.js, and Leaflet are loaded from unpkg.com and jsdelivr.net using version pinning and integrity hashes.
- These downloads are performed to support data visualization, 3D rendering, and mapping capabilities.
- [DYNAMIC_EXECUTION]: Local automation scripts use dynamic evaluation to enable core prototyping functionality.
- The
build-preview.mjsscript usesnew Functionto initialize the Babel compiler and to execute component logic within isolated preview 'cards'. - This usage is restricted to the intended purpose of the skill and is implemented with a proxy-based sandbox to improve isolation.
- [OBFUSCATION]: The skill vendors minified production builds of major open-source libraries.
- Scripts for React, ReactDOM, and Babel are included in the
scripts/vendor/directory to support offline operation. These are verified production distributions of the respective projects. - [COMMAND_EXECUTION]: The toolkit utilizes the local shell and Node.js for project management and previewing.
- Commands are used for design system compilation, asset recording, and running a local development server via
nsl serve.
Audit Metadata