opendesign-tokens
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes Node.js scripts designed to fetch design token metadata from a public package registry to support its validation and conversion features.
- Evidence:
scripts/lib/package-resolver.mjscontains logic to download and extract the@opensig/opendesign-tokenpackage fromhttps://registry.npmjs.org. - Purpose: This mechanism maintains a local cache of CSS and JSON token definitions for offline validation.
- [COMMAND_EXECUTION]: The skill provides a CLI utility (
scripts/bin.mjs) intended for local project maintenance and design system compliance checking. - Capabilities: The tool supports scanning local directories, checking token existence, and providing suggestions for misspelled token names.
- Evidence: The
scanandcheckcommands inscripts/bin.mjsperform read-only operations on the project's source code to identify CSS variable usage.
Audit Metadata