ui-color-palette-sketch
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
run_codetool to execute local JavaScript snippets inreferences/extract-source-colors.mdandreferences/extract-styles-colors.md. These scripts utilize thesketchmodule to programmatically access the current document's selection and shared styles to extract color data. This is a standard implementation for Sketch automation. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads color hex values and style names from the user's active Sketch document. This data is used to populate local
ColorConfigurationandPaletteDataobjects within the agent's context and is not transmitted to external or untrusted domains. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from Sketch documents (layer names and style names) which could theoretically be manipulated by an attacker to include malicious instructions.
- Ingestion points: Data is extracted via the
run_codescripts inreferences/extract-source-colors.mdandreferences/extract-styles-colors.md. - Boundary markers: The workflow includes a human-in-the-loop step (Step 2 in both extraction files) where the agent presents the extracted colors and names to the user for role assignment, acting as a manual verification boundary.
- Capability inventory: The skill has the capability to write to the Sketch document and execute local code via
run_code. - Sanitization: Extracted data is parsed as JSON and mapped into structured configuration objects with specific field validation.
Audit Metadata