design-systems

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill references an installation script (scripts/install-external-skills.py) for external dependencies. The pattern is consistent with modular skill management within the platform and author context.
  • [COMMAND_EXECUTION]: Extensive use of the shadcn CLI (npx shadcn@latest) is documented for component management. This is a standard, well-known utility for managing UI components in the React ecosystem.
  • [INDIRECT_PROMPT_INJECTION]: The scripts/audit_design_tokens.py script performs read-only regex scanning of local source code for design tokens.
  • Ingestion points: Local file system via os.walk in scripts/audit_design_tokens.py.
  • Boundary markers: Absent.
  • Capability inventory: Read-only file access and stdout printing in scripts/audit_design_tokens.py.
  • Sanitization: Regex pattern matching for hex colors and pixel values.
  • [DYNAMIC_CONTEXT_INJECTION]: The hooks/pre-tool.sh script executes find and grep commands to check for design system files. The logic is advisory, non-blocking, and does not perform network operations or access sensitive credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 09:46 AM