design-tokens

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates communication with other AI agent tools (gpt-image-2 and nano-banana) by programmatically invoking their entry-point scripts through subprocess.run to generate imagery.
  • [COMMAND_EXECUTION]: The tool launches temporary local HTTP servers on 127.0.0.1 using the Python http.server module to provide a proper security origin for design previews and an interactive image annotator.
  • [EXTERNAL_DOWNLOADS]: Generated previews and example files fetch resources from trusted and well-known services, including typography from Google Fonts and common development libraries from established CDNs like jsDelivr, unpkg, and cdnjs.
  • [EXTERNAL_DOWNLOADS]: When a user provides an API key, the annotation interface sends audio data to Groq's transcription endpoint via urllib.request as part of its documented voice-to-text functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 09:33 PM
Security Audit — agent-trust-hub — design-tokens