visual-design-system-extractor
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to retrieve metadata from trusted and well-known services:
scripts/google_fonts_api.pyfetches font metadata from Google's official fonts API (fonts.google.com).scripts/sync_mise_primitives.pydownloads JSON schemas for themisedevelopment tool from its official repository on GitHub (raw.githubusercontent.com/jdx/mise).- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to perform necessary orchestration and testing tasks: scripts/run_agentic_request.pyexecutes specified runner tools to facilitate model-owned requests.scripts/screenshot_preview.pyutilizes the Playwright library to launch a headless browser for capturing visual evidence of the design system.scripts/sync_mise_primitives.pyruns local commands likemise --versionto verify environment state.- [INDIRECT_PROMPT_INJECTION]: The skill provides an interface for processing external design references (images and site URLs). It mitigates injection risks through structured data contracts (YAML schemas), deterministic validation gates, and instructions that explicitly require the agent to ground its findings in visible evidence rather than speculative description.
Audit Metadata