Audit History
extract-design-system - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 9, 2026, 09:06 AM | No confirmed findings | 3 | No capability change |
| v8 | Jul 9, 2026, 09:06 AM | No confirmed findings | 3 | No capability change |
| v7 | Jul 9, 2026, 04:11 AM | No confirmed findings | 3 | No capability change |
| v6 | Jul 9, 2026, 01:16 AM | No confirmed findings | 3 | No capability change |
| v5 | Jul 7, 2026, 08:11 PM | No confirmed findings | 3 | No capability change |
| v4 | Jul 5, 2026, 02:05 AM | No confirmed findings | 3 | No capability change |
| v3 | Jul 5, 2026, 02:05 AM | No confirmed findings | 3 | No capability change |
| v2 | Jun 28, 2026, 10:32 AM | No confirmed findings | 1 | No capability change |
| v1 | Apr 9, 2026, 08:47 AM | No confirmed findings | 0 | Baseline |
Jul 9, 2026, 09:06 AM
The skill contains legitimate instructions to run npx commands from SKILL.md, including package execution and Playwright setup. Several static hits are markdown code fences or inline file names and are false positives for Ruby backtick execution. No prompt injection or malicious data exfiltration intent was found in the reviewed files.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
Jul 9, 2026, 09:06 AM
The skill contains legitimate instructions to run npx commands from SKILL.md, including package execution and Playwright setup. Several static hits are markdown code fences or inline file names and are false positives for Ruby backtick execution. No prompt injection or malicious data exfiltration intent was found in the reviewed files.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
Jul 9, 2026, 04:11 AM
The real risks are limited to intentional npx commands used to install Chromium and run the design-system extractor against public URLs. Most static hits are Markdown fences or output path references, and no prompt injection or malicious intent was found in the reviewed files.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
Jul 9, 2026, 01:16 AM
The skill intentionally runs external npx commands, including Playwright browser setup and the extract-design-system CLI. Most static findings are markdown backtick false positives, but the actual command instructions create normal supply-chain and untrusted-URL risks.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
Jul 7, 2026, 08:11 PM
The real security concern is that the skill instructs agents to run external npx commands, including commands with a user-supplied URL argument. The remaining static hits are markdown fences, workflow prose, or generated output path references. I found no prompt-injection attempt or malicious intent in SKILL.md.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
Jul 5, 2026, 02:05 AM
Three static findings are confirmed because the skill instructs agents to run npx and Playwright commands. The remaining detections are Markdown fences or output path references, not executable behavior. No prompt injection or data exfiltration intent was found.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
Jul 5, 2026, 02:05 AM
Three static findings are confirmed because the skill instructs agents to run npx and Playwright commands. The remaining detections are Markdown fences or output path references, not executable behavior. No prompt injection or data exfiltration intent was found.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
Jun 28, 2026, 10:32 AM
Static analysis detected many command and weak-crypto patterns, but review found no prompt injection, malicious intent, network exfiltration, or real cryptographic code. The external-command findings are valid because the skill tells agents to run npx-based tools, so publication is acceptable only with a warning about user approval and package trust.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Risk Factors
⚙️ External commands (23)
Detected Patterns
Apr 9, 2026, 08:47 AM
AI analysis failed after multiple attempts - MANUAL REVIEW REQUIRED before publishing. This skill cannot be auto-published until reviewed by a human.