The Agent Skills Directory

[SAFE]: The skill's primary functionality involves auditing source code and configuring repository hooks, all of which are documented and behave as expected for a linting tool.
[COMMAND_EXECUTION]: The Python script scripts/check_design_tokens.py uses subprocess.run to call the local git binary. This is used solely to identify files changed in the repository and uses a fixed set of arguments, posing no security risk.
[PERSISTENCE]: The skill provides a mechanism to install a git pre-commit hook. While this ensures the skill runs automatically in the future, it is a transparently documented feature intended for enforcing design standards and does not attempt to hide its presence.
[INDIRECT_PROMPT_INJECTION]: The skill reads and processes local source files which could potentially contain adversarial content. However, the script is focused on extracting specific styling patterns and includes a comment-masking feature (mask_comments) to reduce the risk of processing unintended data. The capabilities associated with this ingestion are limited to local auditing.

design-token-guard