data-viz-palette
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill utilizes
npx @basiclines/rampato fetch and execute a package from the npm registry. The@basiclinesorganization is not recognized as a trusted source, presenting a risk of supply chain attack or execution of malicious code. - [COMMAND_EXECUTION] (HIGH): The skill relies on executing shell commands (
rampa) to generate palettes. These commands are constructed by interpolating user-provided inputs like<brand-color>. This is a significant security risk as it provides a direct path for command injection if the agent does not properly sanitize the input. - [REMOTE_CODE_EXECUTION] (HIGH): The combination of downloading untrusted packages via
npxand providing a mechanism for command injection via shell interpolation allows for potential remote code execution on the user's machine.
Recommendations
- AI detected serious security threats
Audit Metadata