migrate-design-system
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious behavior, prompt injection, or data exfiltration patterns were detected. The skill operates on design system metadata using local resources.
- [COMMAND_EXECUTION]: The skill invokes a local script (
.claude/skills/_ux-ui-shared/scripts/contrast.py) and a command-line tool (a11y-audit) to perform accessibility checks. These executions are scoped to the skill's stated purpose of verifying design token mappings. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential attack surface by processing external design system data.
- Ingestion points: User-supplied design system names, component library names, and token specifications.
- Boundary markers: None specified.
- Capability inventory: Execution of local Python scripts and accessibility audit tools.
- Sanitization: None specified. While the surface exists, the risk is minimal as it processes design tokens for visual audits.
Audit Metadata