token-build
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The instructions involve running local Python scripts (validate_tokens.py and contrast.py) located within the project's internal directories for validation and accessibility checks. These are standard operations within a build pipeline and use local file paths.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes design tokens from JSON files.\n
- Ingestion points: Data is read from .claude/skills/_ux-ui-shared/tokens/*.json files.\n
- Boundary markers: None are specified for the token data ingestion.\n
- Capability inventory: Limited to local script execution and file generation (CSS, JS, iOS/Android artifacts).\n
- Sanitization: No explicit sanitization of the JSON content is mentioned before processing.\n
- Assessment: Given the context of a design build system, this surface is considered functional and poses no significant security risk.
Audit Metadata