design-sync

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs several local operations including npx storybook build, npm install, and the execution of Node.js scripts such as package-build.mjs and package-validate.mjs to bundle the user's design system.
  • [EXTERNAL_DOWNLOADS]: The instructions require the agent to install well-known development tools from the NPM registry, specifically esbuild, ts-morph, and playwright. It also triggers the installation of the Chromium browser for visual verification.
  • [REMOTE_CODE_EXECUTION]: The skill utilizes dynamic execution for its core bundling and validation logic.
  • package-build.mjs and lib/preview-rebuild.mjs support loading local logic overrides via import() from the .design-sync/overrides/ directory.
  • package-validate.mjs evaluates the syntax of the generated JavaScript bundle using new Function(). These patterns are consistent with the skill's purpose as a code transpiler and bundler.
  • [DATA_EXFILTRATION]: The skill reads repository source code and documentation to package them for upload to the claude.ai/design platform. Path validation logic in lib/common.mjs and package-build.mjs is used to prevent access to files outside the intended workspace root.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 12:43 PM
Security Audit — agent-trust-hub — design-sync