Is skills/frontend-design safe?
https://github.com/anthropics/skills/tree/main/skills/frontend-design
The frontend-design skill is a pure markdown prose document providing aesthetic direction and design process guidance with no executable code, no sensitive file access instructions, and no external data transmission vectors. Monitoring confirmed clean installation behavior — the only network activity was the expected GitHub clone, canary files remained intact, and all filesystem changes were confined to the skill installation directory. The skill is safe to install and use.
Category Scores
Findings (3)
INFO Skill instructs agent to consult user memory for design personalization -3 ▶
SKILL.md instructs the agent to use any stored memory about the user's preferences, ongoing projects, and past designs to inform aesthetic choices. This is standard behavior for a context-aware design assistant and poses no meaningful prompt injection risk, but warrants noting as the skill actively directs the agent to surface and apply user-specific context.
INFO Canary file accesses observed — attributed to audit framework lifecycle -3 ▶
Inotifywait and auditd PATH records show OPEN/ACCESS events against all six canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) at two points: immediately at monitoring start (audit timestamp 1787180009.955, ~6 seconds before git clone) and at monitoring end (1787180021.975, after install completes). The timing and absence of any write/exfil syscalls strongly indicate these are audit framework setup and teardown operations. The authoritative integrity check confirms all files intact.
INFO Expected outbound HTTPS connection to GitHub during installation 0 ▶
The installation process made a single HTTPS connection to 140.82.121.4:443 (GitHub) to clone the anthropics/skills monorepo with sparse checkout. This is the expected and legitimate install mechanism. No other external connections were initiated by the skill installation.