Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local design-system helper that stores design preferences in a disclosed local folder and does not include code, network calls, or hidden high-impact behavior.
Before installing, be aware that the skill will keep durable local notes about your design system, stack, platforms, team context, constraints, and preferences under ~/design-system/. Avoid putting secrets or sensitive business details there, and review or delete that folder if you no longer want the saved context.
The activation guidance is broad enough to trigger the skill whenever the user is doing general UI or component work, which can cause the agent to invoke the skill outside the user's explicit intent. In practice, this increases the chance of unexpected behavior, unnecessary persistence, and accidental application of design-system rules in unrelated conversations.
The skill instructs the agent to store user preferences and team/context details in a local memory file without first informing the user that this information will be persisted. This creates a privacy and consent issue because users may reveal workflow, team, or platform details assuming they are only part of the current conversation, not durable storage.
No suspicious patterns detected.
