design-sync
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs several local operations including
npx storybook build,npm install, and the execution of Node.js scripts such aspackage-build.mjsandpackage-validate.mjsto bundle the user's design system. - [EXTERNAL_DOWNLOADS]: The instructions require the agent to install well-known development tools from the NPM registry, specifically
esbuild,ts-morph, andplaywright. It also triggers the installation of the Chromium browser for visual verification. - [REMOTE_CODE_EXECUTION]: The skill utilizes dynamic execution for its core bundling and validation logic.
package-build.mjsandlib/preview-rebuild.mjssupport loading local logic overrides viaimport()from the.design-sync/overrides/directory.package-validate.mjsevaluates the syntax of the generated JavaScript bundle usingnew Function(). These patterns are consistent with the skill's purpose as a code transpiler and bundler.- [DATA_EXFILTRATION]: The skill reads repository source code and documentation to package them for upload to the
claude.ai/designplatform. Path validation logic inlib/common.mjsandpackage-build.mjsis used to prevent access to files outside the intended workspace root.
Audit Metadata