The Agent Skills Directory

[COMMAND_EXECUTION]: The reference/migration.md file contains several shell commands designed to audit a codebase for hardcoded design values. These commands utilize standard tools like grep, sort, and uniq to identify hex colors, pixel values, and CSS variables. These are standard development utility commands and do not pose a security risk as they are scoped to design-related patterns.
[INDIRECT_PROMPT_INJECTION]: The skill includes an audit phase that ingests content from the project's src directory, creating a potential surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: reference/migration.md (Bash commands auditing the src/ directory for colors and dimensions).
Boundary markers: Absent; the instructions do not specify delimiters for the data returned by the audit commands.
Capability inventory: SKILL.md defines Bash, Write, and Grep as allowed tools.
Sanitization: Implicit; the search patterns are restricted to specific design-related formats (hex, px, rgba), which naturally filters the ingested data to specific literals.
[SAFE]: The skill follows security best practices by recommending explicit mapping tables for migrations rather than silent global replaces, and by specifying clear naming grammars that separate primitive values from semantic roles. The use of Bash and Write tools is consistent with its stated purpose of auditing code and exporting design system artifacts.

design-tokens