The Agent Skills Directory

[SAFE]: The skill implements a local script for processing design system palettes. It uses built-in Node.js modules to read configuration and write resulting tokens to a local directory.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from .brandfy/palette.json. However, it includes an explicit sanitization layer via the normalizeHex function, which validates that all color inputs match a strict hexadecimal regex (/^#[0-9a-f]{6}$/i). This prevents malicious content from being interpolated into the generated CSS, JSON, or JavaScript theme files.
[COMMAND_EXECUTION]: The execution logic is limited to a controlled Node.js script. Argument parsing is restricted to specific --input and --output flags, preventing arbitrary parameter injection.
[DATA_EXFILTRATION]: No network access or data exfiltration patterns were detected. The script does not use any communication APIs (like fetch or http) and only interacts with the local file system.

brandfy-design-tokens