design-system
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill implements its core functionality through a series of Bash scripts (audit.sh, diff.sh, export.sh, spec.sh, audit-extensions.sh) that wrap the canonical designmd CLI and utility Python scripts. These are used to validate tokens, detect regressions, and generate Tailwind configurations.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a governance layer that reads and interprets DESIGN.md and globals.css files to guide agent behavior during UI development. This creates a potential surface for indirect prompt injection if malicious content is embedded within those design files.\n
- Ingestion points: Ingests content from DESIGN.md frontmatter and prose, as well as globals.css @theme blocks, via scripts/audit_extensions.py and the default governance workflow in SKILL.md.\n
- Boundary markers: The skill does not employ explicit delimiters or instructions to the agent to ignore instructions embedded within the data files it processes.\n
- Capability inventory: The skill is authorized to perform file reads/writes and execute shell commands through its bundled scripts.\n
- Sanitization: Input is processed via regular expression-based parsing in Python and validated against the schema defined by the external designmd CLI.\n- [EXTERNAL_DOWNLOADS]: The skill documentation refers to the @google/design.md package as a required external dependency and points to its official GitHub repository for specifications. These references target well-known and reputable sources.
Audit Metadata