design-component
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several local utility scripts to automate component scaffolding and verification, including
python3 scripts/scaffold_component.pyand various Node.js scripts for accessibility and contrast auditing (e.g.,axe_audit.mjs,verify_states.mjs). - [DYNAMIC_EXECUTION]: The skill provides a Playwright Javascript snippet for the agent to launch a Chromium browser instance, navigate to local component harnesses, and capture screenshots for visual inspection. The results are stored locally at
/tmp/x.png. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific documentation and design tokens which serves as an entry point for untrusted data if the project files are compromised.
- Ingestion points: Reads
CLAUDE.md,accessibility/aria-patterns.md,taste/design-taste.md, andtokens/*.json. - Boundary markers: None provided in the skill instructions.
- Capability inventory: Includes shell command execution (Python/Node) and browser automation (Playwright/Chromium).
- Sanitization: No explicit sanitization is performed on the ingested file content before it is used to generate component specifications.
Audit Metadata