design-systems
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill references an installation script (
scripts/install-external-skills.py) for external dependencies. The pattern is consistent with modular skill management within the platform and author context. - [COMMAND_EXECUTION]: Extensive use of the
shadcnCLI (npx shadcn@latest) is documented for component management. This is a standard, well-known utility for managing UI components in the React ecosystem. - [INDIRECT_PROMPT_INJECTION]: The
scripts/audit_design_tokens.pyscript performs read-only regex scanning of local source code for design tokens. - Ingestion points: Local file system via
os.walkinscripts/audit_design_tokens.py. - Boundary markers: Absent.
- Capability inventory: Read-only file access and stdout printing in
scripts/audit_design_tokens.py. - Sanitization: Regex pattern matching for hex colors and pixel values.
- [DYNAMIC_CONTEXT_INJECTION]: The
hooks/pre-tool.shscript executesfindandgrepcommands to check for design system files. The logic is advisory, non-blocking, and does not perform network operations or access sensitive credentials.
Audit Metadata