design
Pass
Audited by Gen Agent Trust Hub on Jun 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands through
npx playwright screenshotas part of its visual verification loop. This is a legitimate use of the tool to capture screenshots of local development servers (e.g., http://localhost:PORT) to verify design implementation across different viewports (375, 768, 1440). - [EXTERNAL_DOWNLOADS]: The skill incorporates external integrations and tools to facilitate design tasks. This includes the use of the Figma MCP for retrieving design context and screenshots, and the potential installation of Playwright via
npx. These interactions target well-known services and official repositories, which are appropriate for the skill's primary purpose as a design assistant. - [SAFE]: All identified behaviors, including file system access for design tokens (e.g.,
tokens.json,tailwind.config.*) and brand research via web search, are consistent with the documented purpose of the skill and do not involve unauthorized data exfiltration or credential access.
Audit Metadata