The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected across the skill files. The instructions follow standard UI design and developer handoff practices.
[COMMAND_EXECUTION]: The skill includes a local script (scripts/design_token_generator.py) for processing design data. Technical review of the script confirms it is limited to mathematical operations using the standard colorsys and json libraries. It does not perform network requests, file system modifications, or execution of external commands.
[INDIRECT_PROMPT_INJECTION]: While the skill processes user-provided brand colors as input, the ingestion surface is limited to hexadecimal color strings processed by a conversion routine. The script lacks dangerous execution capabilities such as eval() or exec(), mitigating risks associated with untrusted data ingestion.
[DATA_EXPOSURE]: The analysis found no evidence of hardcoded credentials, sensitive file path access, or unauthorized data exfiltration patterns. References to configuration files like .env are provided within the context of standard developer best practices for secret management.

ui-design-system