15Low
The skill introduces supply chain risks by fetching unpinned external assets and insecurely piping API responses directly into local files, enabling potential arbitrary code injection.
Skill Info
Namesleekdotdesign/agent-skills/sleek-design-mobile-apps
Registrygithub
Version86079671c159
PURLpkg:github/sleekdotdesign/agent-skills@86079671c159?skill=sleek-design-mobile-apps
Stars432
Installs298,600
Source
Install
GitHub
298,600 installs
Skills.shDocs
npx skills add https://github.com/sleekdotdesign/agent-skillsAssessments (2)
AI Agent Traps ↗Implicit trust in external icon APIlowsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
The skill instructs the agent to fetch SVGs from `api.iconify.design` and embed them into the codebase. This introduces a dependency on an external, unpinned service that could be used to inject malicious SVG payloads into the user's project.
80% confidenceline 475
GET https://api.iconify.design/{prefix}/{name}.svgPotential for arbitrary file write via API responselowcommand executionAML.T0050AML.T0053AML.T0072LLM05:2025LLM06:2025
The instructions encourage piping API responses directly into files on the local system. If the API endpoint is compromised or if an attacker can influence the `code` field in the JSON response, this could lead to arbitrary file writes or code injection.
70% confidenceline 505
Instead, use shell commands to fetch the API response and write it directly to disk (e.g., pipe the response body into a file).
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/sleekdotdesign/agent-skills/sleek-design-mobile-apps)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/sleekdotdesign/agent-skills/sleek-design-mobile-apps"><img src="https://mondoo.com/ai-agent-security/api/badge/github/sleekdotdesign/agent-skills/sleek-design-mobile-apps.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/sleekdotdesign/agent-skills/sleek-design-mobile-apps.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow