kitchen-sink-design-system
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a development tool focused on UI/UX workflows and component management within a local project environment.
- [COMMAND_EXECUTION]: The skill includes a local bash utility (
scripts/scan-components.sh) designed to inventory existing components. The script uses standard system commands (find,grep,wc) to scan the project directory for specific file patterns and does not perform any network operations or use untrusted input for command construction. - [EXTERNAL_DOWNLOADS]: The documentation suggests using well-known developer tools such as
pnpm dlx @axe-core/clifor accessibility auditing and standard package managers for UI libraries. These references target established, reputable registries and services. - [INDIRECT_PROMPT_INJECTION]: During the discovery phase, the skill instructs the agent to read local project files (e.g.,
GEMINI.md,.cursorrules) to extract brand guidelines and design tokens. This ingestion of local data is the primary purpose of the 'Adopt' mode and is conducted within the project context to inform the agent's creative output. - Ingestion points:
SKILL.md(Phase 0) reads files likeGEMINI.md,CLAUDE.md, and.cursorrulesfrom the project root. - Boundary markers: None explicitly specified for these read operations.
- Capability inventory: File system read access, local bash script execution, and standard package manager calls.
- Sanitization: The agent is instructed to extract specific tokens (colors, fonts, adjectives) for use in styling components.
Audit Metadata