design-tokens

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run local Python scripts (scripts/validate_tokens.py and scripts/contrast.py) to validate JSON structure and verify color contrast ratios. These operations are restricted to the local development environment.- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from local files which represents a potential surface for indirect instructions. 1. Ingestion points: CLAUDE.md, tokens/colors.json, tokens/typography.json, tokens/spacing.json, tokens/shadows.json, tokens/borders.json, tokens/breakpoints.json, tokens/motion.json, tokens/gradients.json, tokens/opacity.json, tokens/blur.json, tokens/sizing.json, tokens/states.json, tokens/theming.json. 2. Boundary markers: None present. 3. Capability inventory: Shell command execution (python3 scripts/validate_tokens.py, scripts/contrast.py). 4. Sanitization: None identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 05:32 PM
Security Audit — agent-trust-hub — design-tokens