design-md
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the
@google/design.mdpackage from the NPM registry usingnpx. This is the official command-line interface for the DESIGN.md specification hosted by Google. - [COMMAND_EXECUTION]: Shell commands (
lint,diff,export,spec) are invoked through the CLI tool to process design token files. These operations are performed within the local project context to manage design specifications. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided
DESIGN.mdfiles (evidence:SKILL.mdunder "File anatomy"). While these files contain design data, the use of a formal specification and specialized validation tools (linting) minimizes the risk of the agent misinterpreting embedded instructions as commands. - [SAFE]: All external resource references, including the GitHub repository
google-labs-code/design.mdand the NPM package@google/design.md, originate from a well-known and trusted organization.
Audit Metadata