Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is a text-only set of frontend design guidelines. It explains layout, theming, animation, responsive design, accessibility, and component patterns, then shows HTML and CSS examples. It does not run scripts in the agent environment, write files, read secrets, touch payments, or set up persistence. The main thing to review is that the examples load third-party CSS and JavaScript from public CDNs, including one unpinned 'latest' URL and one unversioned Tailwind CDN URL, which can change over time. The publisher's skill card itself calls out this CDN supply-chain risk and recommends pinned or bundled production assets. The content matches its stated design-guidance purpose, with no hidden or malicious behavior seen.
| Declared purpose | Expert frontend design guidelines for creating beautiful, modern UIs. Use when building landing pages, dashboards, or any user interface. |
| Observed behavior | The package consists of static Markdown guidance and metadata only. It defines a frontend design workflow, CSS theme patterns, animation planning syntax, responsive and accessibility checklists, and HTML snippets that reference Tailwind CSS, Flowbite, Lucide, and Unsplash from CDNs. There are no shell commands, file writes, environment variable reads, credential access, payment code, persistence mechanisms, installers, or binary blobs. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | exceeds purpose | The skill does not directly make network calls. Its HTML examples, if copied into a generated page, would cause a browser to load third-party CSS/JS/images from cdn.tailwindcss.com (line 127), cdn.jsdelivr.net (lines 132-133), unpkg.com (line 138), and images.unsplash.com (line 145). |
| severity | finding |
|---|---|
| low | Unversioned Tailwind CDN script This example loads third-party JavaScript from the Tailwind CDN without a pinned version. If copied into a production page, the code served could change over time. SKILL.md:127 <script src="https://cdn.tailwindcss.com"></script> |
| low | Flowbite CSS from jsDelivr This example loads a third-party stylesheet from cdn.jsdelivr.net. The version is pinned to 2.0.0, but it is still a remote CDN resource. SKILL.md:132 <link href="https://cdn.jsdelivr.net/npm/flowbite@2.0.0/dist/flowbite.min.css" rel="stylesheet"> |
| low | Flowbite JavaScript from jsDelivr This example loads third-party JavaScript from cdn.jsdelivr.net. A browser would execute this remote script. SKILL.md:133 <script src="https://cdn.jsdelivr.net/npm/flowbite@2.0.0/dist/flowbite.min.js"></script> |
| medium | Unpinned latest Lucide script This example uses the tag 'latest', which is not a fixed version and can change over time. It loads and executes third-party JavaScript from unpkg.com. SKILL.md:138 <script src="https://unpkg.com/lucide@latest/dist/umd/lucide.min.js"></script> |
| info | Lucide icon initialization This code runs the previously loaded Lucide library in the browser to create icons, which is normal for that library but depends on the remote script. SKILL.md:139 <script>lucide.createIcons();</script> |
| info | Remote image example Pages built from this guidance may load images from images.unsplash.com. SKILL.md:145 - Example: `https://images.unsplash.com/photo-xxx?w=800&h=600` |
| info | External reference link This is an informational link to the SuperDesign website and not an executable dependency. SKILL.md:213 *Based on SuperDesign patterns — https://superdesign.dev* |
| info | Publisher link This identifies the publisher and links to their ClawHub user page. skill-card.md:9 [mpociot](https://clawhub.ai/user/mpociot) |
| info | Publisher acknowledges CDN risk The publisher's risk statement matches the main concern with the CDN examples in SKILL.md. skill-card.md:24 Risk: Prototype CDN snippets can create supply-chain risk if copied directly into production projects. |
| info | Publisher provides production mitigation The skill card recommends safer production alternatives to the prototype CDN snippets. skill-card.md:26 Mitigation: For production, use locked package dependencies, pinned versions, bundled assets, or SRI-protected CDN resources. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| cdn.jsdelivr.net | not in the service index | SKILL.md:132 |
| cdn.tailwindcss.com | not in the service index | SKILL.md:127 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| images.unsplash.com | not in the service index | SKILL.md:145 |
| superdesign.dev | not in the service index | SKILL.md:213 |
| unpkg.com | not in the service index | SKILL.md:138 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 213 | 12cbb694b936cadb… |
_meta.json | 6 | 0bb8b69c59d6d070… |
skill-card.md | 49 | b2395e57c06d59cf… |
For agents
JSON: https://agenteconomy.report/k/superdesign.audit.json · badge: https://agenteconomy.report/k/superdesign.audited.svg ·
skill rating: /k/superdesign · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).