design-catalog

[Skill Scanner] Backtick command substitution detected The module is functionally coherent for generating design catalogs but enforces mandatory delegation of all generation and content processing to external agent infrastructure (Kimi/Gemini/MCP). That design significantly increases the attack surface and the chance of inadvertent data exposure (screenshots, proprietary UI content). There is no direct evidence of malware (no obfuscated payloads, no credential theft calls, no reverse shell), but the forced multi-agent workflow and parallel spawning elevate the security risk to a moderate level. Recommendation: do not use with sensitive/internal URLs unless you trust the agent infrastructure and have documented data-handling guarantees; if possible, allow local generation or sanitize/redact screenshots before sending. LLM verification: No direct malicious code was found in the skill text itself. However, the skill mandates delegation of all generation to an external agent (Kimi) and instructs capturing and forwarding screenshots and web-grounded data without any stated privacy/sanitation controls. That design is disproportionate to the stated purpose because it centralizes and multiplies the risk of leaking sensitive or private content to third-party agents. Recommend: treat this skill as SUSPICIOUS for data-exfiltration risk