michelangelo
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs well-known libraries and frameworks from the npm registry, including
vite,tailwindcss,shadcn, and icon sets like@phosphor-icons/reactandlucide-react. These resources are provided by trusted vendors and are standard for modern web development.\n- [REMOTE_CODE_EXECUTION]: Usesnpxto execute@playwright/mcpandshadcndirectly from the npm registry. These operations are part of a documented and legitimate setup process for visual validation and UI scaffolding.\n- [COMMAND_EXECUTION]: Executes shell commands to detect the user's environment, such as identifying the installed package manager (bun,pnpm,yarn,npm) and checking for agent-specific configuration files (e.g.,.cursor/mcp.json,.gemini/settings.json).\n- [COMMAND_EXECUTION]: If authorized by the user, the skill modifies project configuration files (such as.mcp.json) to install the Playwright MCP server. The presence of a clear authorization prompt ensures the user maintains control over their agent's configuration.
Audit Metadata