design-data
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to bootstrap an MCP server using
@adobe/design-data-mcpvianpx. - Evidence: The package
@adobe/design-data-mcpis a vendor-owned resource associated with the skill author (adobe). - Evidence: The skill references a remote rule hosted on Adobe's official GitHub repository:
https://github.com/adobe/spectrum-design-data/. - [REMOTE_CODE_EXECUTION]: The skill configuration executes a remote package as a command-line tool to provide its core functionality.
- Evidence: The
Bootstrapsection provides an MCP configuration using"command": "npx"and"args": ["-y", "@adobe/design-data-mcp"]. This executes the latest version of the Adobe-authored MCP server. - [INDIRECT_PROMPT_INJECTION]: The
design-data-queryanddesign-data-suggesttools ingest natural language strings from the user context. - Evidence:
design-data-queryaccepts afilterstring anddesign-data-suggestaccepts anintentstring. While these process untrusted user data, the tools are scoped to querying a static design-token snapshot, which limits the potential impact of adversarial input.
Audit Metadata