design-cli
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and installs the
@google/design.mdpackage from the official NPM registry. This tool is used for validating design systems and exporting tokens to formats like Tailwind CSS. As a package from a trusted organization, this is considered a safe and intended dependency. - [COMMAND_EXECUTION]: Provides standard CLI usage examples (e.g.,
npx @google/design.md lint) for managing design documentation. These commands are executed by the user to perform design-related tasks and do not involve unauthorized or hidden operations. - [INDIRECT_PROMPT_INJECTION]: The skill defines a structured data format (
DESIGN.md) for agents to ingest. It utilizes clear boundary markers including YAML frontmatter fences (---) and Markdown headings (##) to maintain structural integrity, which helps mitigate accidental interpretation of design data as instructions.
Audit Metadata