design-parity-review
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to execute several Node.js packages using
npx, includingdesign-parity,@design-parity/kit-index, and@yschimke/compose-design-map. These tools are downloaded from npm at runtime to perform design mapping and parity checks. - [REMOTE_CODE_EXECUTION]: The skill configuration relies on reusable GitHub Workflows (
yschimke/design-parity/.github/workflows/design-parity-reusable.ymlanddesign-parity-import-reusable.yml) which execute logic within the user's CI/CD environment. These workflows are used to automate the import of design references and the generation of parity reports. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests external data that could be controlled by an attacker.
- Ingestion points: The tool processes
claude-designHTML exports and Figma node structures (node.json) to generate reports. - Boundary markers: No specific boundary markers or sanitization instructions for these external data sources are mentioned in the documentation.
- Capability inventory: The tool has the ability to post comments on pull requests and commit artifacts to a dedicated GitHub branch (
design-parity/reference). - Sanitization: The skill does not explicitly describe sanitization procedures for the design metadata it processes before using it to generate the final parity verdict.
Audit Metadata