skills/sky-flux/skills/michelangelo/Gen Agent Trust Hub

michelangelo

Pass

Audited by Gen Agent Trust Hub on Mar 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs well-known libraries and frameworks from the npm registry, including vite, tailwindcss, shadcn, and icon sets like @phosphor-icons/react and lucide-react. These resources are provided by trusted vendors and are standard for modern web development.\n- [REMOTE_CODE_EXECUTION]: Uses npx to execute @playwright/mcp and shadcn directly from the npm registry. These operations are part of a documented and legitimate setup process for visual validation and UI scaffolding.\n- [COMMAND_EXECUTION]: Executes shell commands to detect the user's environment, such as identifying the installed package manager (bun, pnpm, yarn, npm) and checking for agent-specific configuration files (e.g., .cursor/mcp.json, .gemini/settings.json).\n- [COMMAND_EXECUTION]: If authorized by the user, the skill modifies project configuration files (such as .mcp.json) to install the Playwright MCP server. The presence of a clear authorization prompt ensures the user maintains control over their agent's configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 14, 2026, 07:21 AM