building-remix-design-system
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides technical instructions for design system development that align with established best practices. It includes guidance on repository layout, analyzed authoring packages, and automated verification loops without introducing dangerous or unauthorized operations.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of configuration and design assets from official vendor repositories and well-known services like GitHub and NPM. These operations are within the primary scope of the skill and utilize security measures such as pinned commit references and integrity hashes.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data from Figma, NPM packages, and design documents. It mitigates risk through structured specification files and deterministic extraction processes.
- Ingestion points: Figma API nodes, NPM token packages, and PDF brand guidelines.
- Boundary markers: Relies on specification manifests (
specs/tokens.yaml) to track provenance and confidence levels for all extracted values. - Capability inventory: Includes file system writes for repository scaffolding and the execution of CLI tools (
remix_cli) for registry management. - Sanitization: Employs Dart analyzer checks on authored source and deterministic derivation scripts to prevent malicious code injection.
Audit Metadata