huashu-design
Huashu Design 3.0 · 在 agent 里打一句话，拿回能交付的设计：网页 / App 原型 / 可编辑 PPTX / 动画 / 信息图 · 六个候选挑三个方向 · 84 种带样张的风格库 · 越用越懂你的外观账本与设计体检 · HTML-native design skill for Claude Code, Codex, Cursor & any agent
No outside reports on file
Use this skill only with trusted prompts and monitor what content the agent generates, since it creates files that could embed malicious code if the generation process is compromised.
Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsNo API token requiredLOW
- Package sourceGitHub (alchaincyf/huashu-design)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/alchaincyf/huashu-design ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-23.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Huashu Design
Huashu Design is a skill (plugin) for AI agents that generates design deliverables from text prompts. It can create website prototypes, app mockups, editable PowerPoint slides, animations, and infographics. The tool offers multiple design direction options and a library of 84+ pre-made styles to choose from.
Who it’s for
AI agent builders and users who want to generate design mockups and prototypes quickly without using traditional design software. It works with Claude Code, Codex, Cursor, and other AI agents.
Alternatives
- Figma API: Programmatic access to Figma for design collaboration and file generation
- Pebblely: AI-powered product photography and mockup generation
- Relume: AI website builder and design system for rapid prototyping
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README on the GitHub repository for installation and integration steps with your specific AI agent platform.
Why this grade
Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 28.1k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Agent autonomy: The skill executes design generation based on agent instructions, so a compromised agent prompt could request inappropriate or unauthorized designs
- Prompt injection in design requests: Malicious text in design prompts might trick the AI into generating unintended content or outputs
- File generation: Creates output files (PPTX, HTML, images) that could contain scripts or embedding tricks if the underlying prompt is manipulated
- Style library exploitation: Pre-made styles could potentially be modified or poisoned if the library source is compromised
- Data in generated designs: Designs may inadvertently include sensitive information if it appears in the input prompt or agent context
How to lower the risk
Least-privilege permissions
- Run the agent with minimal file system access to output directories only
- Restrict the skill to read-only access to style libraries if possible
Network isolation
- Disable any external API calls the skill might make; use offline style libraries
- Keep the skill and agent on a segmented network if handling sensitive projects
Monitoring
- Log all design generation requests and review output files before using them
- Scan generated HTML and PPTX files for embedded scripts or suspicious content
Red flags to watch for
- Designs that reference external URLs or load remote resources
- Generated files larger than expected (may contain hidden data)
- Prompts requesting designs with unusual embedded instructions or code
Questions
How do I install Huashu Design?
Huashu Design does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/alchaincyf/huashu-design.
Are there security reports about Huashu Design?
No reports found for this package in our research (last checked 2026-10-30). Huashu Design currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include agent autonomy, prompt injection in design requests, file generation.
Is Huashu Design actively maintained?
Huashu Design has 28.1k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/alchaincyf/huashu-design before pinning it in production.
What are alternatives to Huashu Design?
Notable alternatives to Huashu Design include Figma API (Programmatic access to Figma for design collaboration and file generation), Pebblely (AI-powered product photography and mockup generation), Relume (AI website builder and design system for rapid prototyping). You can also compare Huashu Design side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use Huashu Design? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/alchaincyf-huashu-design)HTML embed:
<a href="https://agentarmorhq.com/skills/alchaincyf-huashu-design"><img src="https://agentarmorhq.com/api/badge/alchaincyf-huashu-design" alt="AgentArmorHQ Risk Grade for Huashu Design" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "alchaincyf-huashu-design"Share with your security lead
Need sign-off to use huashu-design? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: huashu-design
- **Listing URL:** https://agentarmorhq.com/skills/alchaincyf-huashu-design
- **Type:** AI agent skill
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 28.1k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** GitHub (alchaincyf/huashu-design)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/alchaincyf/huashu-design
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- alchaincyf
- Source code
- github.com/alchaincyf/huashu-design
- Est. context load
- ~75 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 28.1k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-23
Community
Discussions for Huashu Design
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude