ckm-brand
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/sync-brand-to-tokens.cjsutilizeschild_process.execSyncto invoke a local Node.js script located at.claude/skills/design-system/scripts/generate-tokens.cjs. This is used to regenerate CSS variables from updated design tokens. The command execution is restricted to a hardcoded relative path and does not incorporate arbitrary user input, mitigating command injection risks. - [EXTERNAL_DOWNLOADS]: Multiple reference files and templates, including
references/typography-specifications.mdandtemplates/brand-guidelines-starter.md, contain URLs to Google Fonts (https://fonts.googleapis.com). These are standard references for implementing brand typography in web environments and originate from a well-known service. - [SAFE]: The skill performs routine filesystem operations, such as reading markdown guidelines and writing JSON/CSS token files within the project's working directory. These actions are transparently documented and align with the skill's primary purpose of maintaining brand consistency and asset management.
Audit Metadata