design-tokens
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The
generatecommand invokes local Python scripts from other installed skills (gpt-image-2andnano-banana) usingsubprocess.run. This allows the skill to programmatically generate images that adhere to defined brand tokens. - [EXTERNAL_DOWNLOADS]: Standalone HTML previews and mockup examples fetch CSS, JavaScript, and font assets from well-known services, including Google Fonts, Cloudflare CDN, unpkg, and esm.sh. These downloads are required for rendering typography and interactive components in the browser.
- [DATA_EXFILTRATION]: The
annotatecommand provides a voice-to-text feature that sends audio data to the Groq API for processing. This behavior is gated by a user-providedGROQ_API_KEYenvironment variable and is the intended mechanism for transcribing image notes.
Audit Metadata