design-tokens-skill
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is designed as a pointer that fetches a full version of itself from a remote GitHub repository (
github.com/ilikescience/design-tokens-skill) which is not an established trusted source. - [REMOTE_CODE_EXECUTION]: The instructions direct the agent to use
npx skills addto download and install a community-provided skill. This involves executing logic from theskillspackage and the remote repository to install code on the user's system. - [COMMAND_EXECUTION]: The skill provides logic for the agent to execute shell commands, such as
grepand filesystem presence checks ([ -e ... ]), to determine the installation environment and scope. - [COMMAND_EXECUTION]: The documentation encourages the agent to utilize platform-specific execution shortcuts (prefixing commands with
!) to automate the installation of third-party software within the chat session.
Audit Metadata