skills/zapabob/skills/design-md/Gen Agent Trust Hub

design-md

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and executes the @google/design.md package from the NPM registry using npx. This is the official tool for the open-source design specification.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands for linting structure, comparing versions (diff), and exporting tokens to Tailwind or DTCG formats.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided Markdown and YAML content as input for processing.
  • Ingestion points: Reads existing DESIGN.md files or user-pasted design specs (referenced in SKILL.md workflow).
  • Boundary markers: None specific; the skill processes raw file content.
  • Capability inventory: Includes file writing (write_file) and shell execution (npx).
  • Sanitization: Standard CLI parsing by the @google/design.md tool is utilized, but no explicit agent-side sanitization of prompt data is specified.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:07 PM