ui — security audits

Review recommended

Independent security partners scan this skill's files for malicious content, prompt injection and risky patterns. Verdicts below come from the skills.sh audit program; each partner links to its full report.

• Gen Agent Trust Hub

  warn

  The skill contains instructions for the agent to potentially download and execute an external package ('getdesign') from an unverified source via npx, posing a risk of remote code execution. It also processes external, untrusted content like source code and screenshots, which creates an attack surface for indirect prompt injection.

  Risk: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONJul 26, 2026Full report

• Socket

  pass

  No alerts

  Jul 26, 2026Full report

• Snyk

  pass

  Risk: LOW · No issues

  Risk: LOWJul 26, 2026Full report