Is tommyjepsen/awesome-ux-skills safe?
https://github.com/tommyjepsen/awesome-ux-skills
tommyjepsen/awesome-ux-skills is a well-crafted collection of 20+ UX methodology documentation skills covering design frameworks, AI product patterns, and research methods. No prompt injection vectors, hidden instructions, exfiltration code, or malicious network activity were detected; the SKILL.md is intentionally empty and skills are implemented as individual markdown files. Minor concerns include executable install/uninstall scripts (reviewed as benign), broad always-on trigger conditions that may frequently inject skill context, and documented persuasion techniques (Fogg's Captology) that the skill itself explicitly flags as manipulation risks.
Category Scores
Findings (5)
LOW Executable shell scripts (install.sh, uninstall.sh) -13 ▶
The repository ships two bash scripts. uninstall.sh was inspected and uses set -euo pipefail with scoped operations inside ~/.claude/skills. install.sh was not fully reviewed in evidence but its counterpart is clean. Shell scripts in skills repos represent a surface area that must be trusted.
LOW Broad 'Always use this skill' trigger conditions -7 ▶
Multiple skill frontmatter descriptions instruct the agent to activate the skill unconditionally before any UX advice, even for simple requests. This frequent injection can crowd agent context, potentially displacing system safety instructions.
INFO Persuasion and dark-pattern knowledge documented -15 ▶
persuasive-ux.md teaches Fogg's 7 Captology tools including Surveillance and Conditioning. While explicitly anti-dark-pattern in framing, installing this skill gives the agent fluency in psychological manipulation techniques that could be activated by a malicious user prompt.
INFO Canary file read events detected pre- and post-clone -12 ▶
inotify and auditd recorded reads of .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP credentials at two timestamps. Timing analysis places the first batch before the git clone (audit setup) and the second batch at audit teardown. No writes, no outbound exfiltration, canary integrity confirmed intact.
INFO Local file reference instruction in persuasive-ux.md -3 ▶
persuasive-ux.md instructs the agent to read a relative file path (references/tools.md) when deeper context is needed. This is an installed local file, not a remote fetch, so blast radius is minimal, but it creates a habit of agent-initiated local file reads that a poisoned version could exploit.