use-design-system
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external
tokens.jsonfiles which could contain malicious instructions. - Ingestion points:
SKILL.md(Step 3) reads configuration from~/.claude/design-systems/$0/tokens.json. - Boundary markers: Absent. There are no instructions provided to the agent to treat the JSON content as non-executable data or to ignore embedded prompts.
- Capability inventory: The skill has
Read,Write, and limitedBash(ls,mkdir,cp) tools available as defined in theSKILL.mdfrontmatter. - Sanitization: Absent. The file content is read directly into the agent's context without validation or filtering.
- [COMMAND_EXECUTION]: The skill constructs shell commands using the user-provided
$0(design system name) variable. - Evidence:
SKILL.mduses the argument directly in commands such asBash(test -d ~/.claude/design-systems/$0 ...),Bash(mkdir -p .claude), andBash(cp ~/.claude/design-systems/$0/tokens.json ...). If the design system name is not sanitized by the platform, it could lead to command injection.
Audit Metadata