Is skills/ui-ux-pro-max safe?

SKILL.md contains explicit shell invocation instructions for Python scripts bundled with the skill. While the scripts appear to be legitimate search utilities with no observed external network calls, a full static analysis of the Python source was not captured in the audit evidence. Any future update to these scripts could introduce malicious behavior without changing the visible SKILL.md instruction surface. The invocation uses an unsanitized query argument passed directly to the script.

The --persist workflow instructs the agent to write MASTER.md and page override files using an --output-dir parameter supplied by the agent or user. If the output-dir or project slug is crafted to include path traversal sequences (e.g., ../), the Python script could write outside the intended design-system/ subdirectory. The skill's guidance is sound (explicit --force gating) but the path sanitization depends entirely on the Python implementation.

SKILL.md instructs the agent to read package.json, pubspec.yaml, app.json, Package.swift, *.xcodeproj, and composer.json from the user's project to auto-detect the technology stack. This is documented and benign, but it means activation of this skill causes the agent to read project structure and dependency files during normal operation. Any data sent in search queries could inadvertently include file content if the agent incorrectly follows the prohibition on private project data.

SKILL.md instructs the agent to load references/quick-reference.md (119 UX rules, ~large) and references/pro-rules.md (pre-delivery checklist) into context on demand. Both files contain only legitimate UI/UX guidance with no injection payloads detected. However, these files expand the total instruction surface injected into the agent's context window and could in theory be updated to contain adversarial content in a future repo push.

Honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .config/gcloud/application_default_credentials.json) were opened and read-accessed at two points: timestamp 1787180602 (approximately 5 seconds before git clone) and 1787180614 (after install completion). Timing strongly indicates these correspond to the audit monitoring framework's baseline setup and final integrity verification phases, not to the skill. All files confirmed intact by canary integrity check.

Installation performed a shallow clone of the monorepo, applied sparse-checkout to extract only the .claude/skills/ui-ux-pro-max subpath, copied files to destination, and cleaned up /tmp/monorepo-clone. All activity is traceable in auditd EXECVE logs and consistent with expected skill installation behavior. No extraneous network connections initiated.

During normal UI/UX tasks, the skill instructs the agent to inspect the user's project for stack detection before applying recommendations. This is intentional and disclosed in SKILL.md but results in the agent reading configuration files (package.json, etc.) as a side effect of any UI design request.

Both the --output-dir flag and the -p (project name) argument influence the final write path for persisted design system files. The project slug is derived from the project name via slugification in the Python script. If slug generation does not sanitize sequences like ../ or absolute paths, an agent following instructions with a crafted project name could write files to arbitrary locations accessible to the agent. Exploitation requires the agent to use --persist with attacker-controlled input.