design-tokens-transformer
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements logic for the automated transformation of design assets. It instructs the agent to read, parse, and generate code for file paths such as
assets/round3/02-tokens.json,colors_and_type.css, andassets/round3/globals.css. - [EXTERNAL_DOWNLOADS]: The skill references external resources from well-known and trusted providers. It includes instructions to fetch font configurations from Google Fonts (
fonts.googleapis.com) and references the official W3C Design Tokens Community Group schema (design-tokens.github.io). - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes external design token files (JSON/CSS) to generate production code.
- Ingestion points: Files like
02-tokens.jsonand CSS handoff bundles. - Boundary markers: The instructions define strict schemas and 'FROZEN' rule annotations to delimit token data.
- Capability inventory: The agent is tasked with file reading, value mapping, and stylesheet generation.
- Sanitization: The skill includes normalization rules for hex codes, dimensions, and font stacks to ensure data consistency during the conversion process.
Audit Metadata