boring-design-system
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
shadcnCLI, a well-known utility in the React ecosystem, for component installation and theme application. This is a standard developer workflow for UI management. - [COMMAND_EXECUTION]: Instructions include running project-specific validation scripts (
npm run kit,npm run design) and environment information commands (npx shadcn@latest info). These commands are used for verifying design invariants and ensuring consistency across the application UI. - [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration data from
DESIGN.md. This ingestion is restricted to mapping visual tokens (colors, fonts, radii) to CSS variables in a theme file and does not involve executing the data as code or interpolating it into high-privilege operations.
Audit Metadata