design-tokens

SUSPICIOUS: the local design-token core is coherent and mostly benign, but the skill’s footprint expands into external prompt/image generation, browser serving, and optional third-party API/script use. The main concerns are unspecified downstream skill-script trust and moderate autonomous external actions, not clear malware or credential theft.

No clear evidence of embedded malware in this fragment (no network exfiltration, credential theft, or obfuscated payloads). However, it is security-relevant orchestration code: it executes local Python scripts from hardcoded ~/ .claude/skills/... paths without integrity checks and passes manifest-derived reference file paths and generated prompt text to those scripts. If the referenced scripts or manifest inputs are tampered with, an attacker can influence what external code runs and what files the external scripts access. Treat this as a potentially risky execution dispatcher rather than a self-contained safe library.