design-spec
How to author a DESIGN.md file — the machine-readable design-token + human-rationale format that must exist before any UI is built. YAML front-matter token schema (colors, typography, spacing, rounded, components), type system, token references, and canonical section order.
61
73%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Fix and improve this skill with Tessl
tessl review fix ./.agents/skills/design-spec/SKILL.mdLow
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow says the agent must “read collection.md first” and then “open their DESIGN.md on GitHub, and study how they structure tokens,” which implies ingestion of outsider-authored, free-form markdown content from third-party repositories/pages into the LLM context at runtime (public web/GitHub-fetched content category).
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill's workflow explicitly tells the agent to "ALWAYS read collection.md first" and then open external DESIGN.md files on GitHub (e.g., https://github.com/VoltAgent/awesome-design-md/blob/main/design-md/claude/DESIGN.md), which is clear evidence the agent would fetch remote content at runtime that can directly influence its instructions; the SKILL.md also references the external spec/tool https://github.com/google-labs-code/design.md.
- Repository
- vudovn/ag-kit
- Commit
04514f0
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.