design-tokens
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that override the agent's standard behavior by explicitly directing it to act autonomously and avoid asking the user questions before performing significant operations. Phrases like 'You do not ask questions' and 'Do NOT ask the user questions' reduce user oversight during mass file modifications.- [COMMAND_EXECUTION]: The skill instructs the agent to execute build and lint commands autonomously (Phase 6.3) to verify the integrity of the generated token system. These commands are executed without individual user confirmation.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and analyzes data from the entire codebase (CSS, TypeScript, Dart, build configs) to 'infer design intent'.
- Ingestion points: Files like package.json, pubspec.yaml, build.gradle, and all style-containing files are scanned and processed.
- Boundary markers: The skill lacks delimiters or instructions to ignore potential commands embedded within the styling data it processes.
- Capability inventory: The agent can rewrite repository files and execute shell commands for project builds and linting.
- Sanitization: The extracted design values are not validated or sanitized before being integrated into the new token architecture.
Audit Metadata