design-tokens

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The generate command invokes local Python scripts from other installed skills (gpt-image-2 and nano-banana) using subprocess.run. This allows the skill to programmatically generate images that adhere to defined brand tokens.
  • [EXTERNAL_DOWNLOADS]: Standalone HTML previews and mockup examples fetch CSS, JavaScript, and font assets from well-known services, including Google Fonts, Cloudflare CDN, unpkg, and esm.sh. These downloads are required for rendering typography and interactive components in the browser.
  • [DATA_EXFILTRATION]: The annotate command provides a voice-to-text feature that sends audio data to the Groq API for processing. This behavior is gated by a user-provided GROQ_API_KEY environment variable and is the intended mechanism for transcribing image notes.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 12:01 AM
Security Audit — agent-trust-hub — design-tokens