opendesign-tokens

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes Node.js scripts designed to fetch design token metadata from a public package registry to support its validation and conversion features.
  • Evidence: scripts/lib/package-resolver.mjs contains logic to download and extract the @opensig/opendesign-token package from https://registry.npmjs.org.
  • Purpose: This mechanism maintains a local cache of CSS and JSON token definitions for offline validation.
  • [COMMAND_EXECUTION]: The skill provides a CLI utility (scripts/bin.mjs) intended for local project maintenance and design system compliance checking.
  • Capabilities: The tool supports scanning local directories, checking token existence, and providing suggestions for misspelled token names.
  • Evidence: The scan and check commands in scripts/bin.mjs perform read-only operations on the project's source code to identify CSS variable usage.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 05:37 AM