OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn4 providerslatest audit May 28, 2026
Independent checks from skills.sh's audit partners.
The design skill provides tools for high-quality UI/UX iteration and component building. It includes a feature to fetch brand presets by executing a third-party package (`getdesign`) via `npx`, which constitutes remote code execution from an unverified source. Additionally, the skill processes user-supplied source code and screenshots, creating an attack surface for indirect prompt injection where malicious instructions could be embedded in the data provided to the agent.
Detected behaviors
No alerts
No issues
Score: 93/100 · 2 sections analyzed