design-tokens-tailwind
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (
scripts/generate-tailwind-theme.mjs) to automate the conversion of design tokens. This execution is performed within the local project environment using code included in the skill package. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific JSON data, which represents a standard data ingestion surface.
- Ingestion points: Data is read from
design-tokens.jsonor user-defined JSON files. - Boundary markers: The instructions direct the agent to inspect file contents, which is necessary for its function.
- Capability inventory: The skill allows for local file writes and execution of the bundled conversion script.
- Sanitization: The conversion script implements strict character filtering for token names and formats values for CSS, providing protection against code injection in the generated output.
Audit Metadata