design-tokens
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run local Python scripts (
scripts/validate_tokens.pyandscripts/contrast.py) to validate JSON structure and verify color contrast ratios. These operations are restricted to the local development environment.- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from local files which represents a potential surface for indirect instructions. 1. Ingestion points:CLAUDE.md,tokens/colors.json,tokens/typography.json,tokens/spacing.json,tokens/shadows.json,tokens/borders.json,tokens/breakpoints.json,tokens/motion.json,tokens/gradients.json,tokens/opacity.json,tokens/blur.json,tokens/sizing.json,tokens/states.json,tokens/theming.json. 2. Boundary markers: None present. 3. Capability inventory: Shell command execution (python3 scripts/validate_tokens.py,scripts/contrast.py). 4. Sanitization: None identified.
Audit Metadata