ckm-brand

Pass

Audited by Gen Agent Trust Hub on Jun 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/sync-brand-to-tokens.cjs utilizes child_process.execSync to invoke a local Node.js script located at .claude/skills/design-system/scripts/generate-tokens.cjs. This is used to regenerate CSS variables from updated design tokens. The command execution is restricted to a hardcoded relative path and does not incorporate arbitrary user input, mitigating command injection risks.
  • [EXTERNAL_DOWNLOADS]: Multiple reference files and templates, including references/typography-specifications.md and templates/brand-guidelines-starter.md, contain URLs to Google Fonts (https://fonts.googleapis.com). These are standard references for implementing brand typography in web environments and originate from a well-known service.
  • [SAFE]: The skill performs routine filesystem operations, such as reading markdown guidelines and writing JSON/CSS token files within the project's working directory. These actions are transparently documented and align with the skill's primary purpose of maintaining brand consistency and asset management.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 29, 2026, 08:00 AM
Security Audit — agent-trust-hub — ckm-brand