maintain-design-md — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited maintain-design-md (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Every Lossless project with a visual surface should have aDESIGN.mdat its root. It is the agent-readable contract that explains the project's visual identity — colors, typography, spacing, components, behavior under hover/focus/dark/light. Both humans and AI agents read it. When the codebase's CSS custom properties drift away from whatDESIGN.mdsays, fixDESIGN.md.
DESIGN.md from scratch — splash, site, plugin landing, fundraise deck--radius-md: 12px), the document says another (e.g. rounded.md: 8px); reconcileimagery: block for the generate-consistent-og-images skill — and you want to know where it belongs and how spec-compliant consumers will handle itgenerate-consistent-og-images, theme-system, astro-knots, open-graph-share-seo-geo) needs to read locked design values and they're not in DESIGN.md yetLossless DESIGN.md files follow Google Stitch's open spec, version alpha (current):
examples/ directory of the spec repo (atmospheric-glass, paws-and-paths, totality-festival)content-farm/splash/DESIGN.md — full canonical example with both standard Stitch sections and an off-spec imagery: extensionA DESIGN.md has two parts: YAML frontmatter (machine-readable tokens) and a markdown body (human-readable rationale).
Top-level frontmatter keys (all optional except name):
| Key | Type | Notes | |
|---|---|---|---|
version | string | Current: "alpha" | |
name | string | The design system name (e.g. "Content Farm — Astro Knots Dark") | |
description | string | One-paragraph summary | |
colors | map\<string, Color\> | Hex (#rrggbb) values. At minimum primary | |
typography | map\<string, Typography\> | fontFamily, fontSize, fontWeight, lineHeight, letterSpacing, fontFeature, fontVariation | |
rounded | map\<string, Dimension\> | Common: sm, md, lg, xl, full | |
spacing | map\<string, Dimension \ | number\> | Numeric for ratio-style, dimensions (px/em/rem) for sizes |
components | map\<string, map\<string, string\>\> | Component tokens; values may reference others via {path.to.token} |
Token references use curly-brace syntax: "{colors.primary}", "{rounded.md}". Most references must point to a primitive value (a single token, not a group). Within components:, references to composite values like "{typography.label-md}" are explicitly permitted.
Dimension values are strings with a unit suffix: px, em, rem. Unitless numbers in lineHeight are treated as multipliers of fontSize (this is CSS-idiomatic).
1. Overview (also: "Brand & Style")
2. Colors
3. Typography
4. Layout (also: "Layout & Spacing")
5. Elevation & Depth (also: "Elevation")
6. Shapes
7. Components
8. Do's and Don'tsSections can be omitted if not relevant, but those present must appear in this order. All section headings are <h2> (##). An optional <h1> may appear for titling but is not parsed as a section. The spec's "Consumer Behavior for Unknown Content" table guarantees that unknown sections and tokens are preserved without errors — so project-specific extensions (see §"Off-spec extensions" below) are safe.
DESIGN.mdWhen a project is missing a DESIGN.md, follow this flow:
:root block of a BaseLayout.astro or theme.css or global.css is where the source-of-truth values live today. The DESIGN.md is a description of those values, not a parallel decision.content-farm/splash/DESIGN.md). The eight section order is canonical; the token-group names (colors, typography, rounded, spacing, components) are canonical; the values belong to whichever project you're documenting.colors.surface-*. Text → colors.on-surface-*. Borders → colors.border*. Brand accents → colors.primary / colors.primary-soft / colors.accent-*. Spacing scale → spacing.*. Border radii → rounded.*. Font stacks → typography.*.> The runtime source of truth is <path-to-css-file>; this document is the human- and agent-readable contract that explains intent. Keep the two in sync when either changes.Template scaffold: templates/design-md-scaffold.md in this skill.
DESIGN.mdA DESIGN.md update is needed whenever any of these happen in the runtime CSS or component layer:
| Trigger | Update to DESIGN.md |
|---|---|
New CSS custom property added to :root | Add a token to colors: / typography: / rounded: / spacing: |
| Existing token's value changed | Update the token value in frontmatter; if the change is non-trivial (e.g. palette shift, font-family swap), update the matching prose section too |
| Token renamed | Rename in frontmatter; grep prose for references and update those too |
New reusable component shipped (<CtaButton>, <PluginCard>, etc.) | Add a components.<name>: entry with the relevant style tokens; add a subsection under ## Components with the component's vocabulary |
| Component prop / variant added | Update the existing component entry; add a paragraph in the matching ## Components subsection |
New mode added (e.g. vibrant next to light and dark) | Extend the color tokens or add a modes: extension block; update ## Brand & Style to describe the mode |
| Spacing or radius scale extended | Add the new step to spacing: / rounded:; update prose in ## Layout & Spacing or ## Shapes |
| New illustrative-asset recipe (e.g. an Ideogram template) | Add an imagery: extension block (see generate-consistent-og-images skill); add an ## Imagery prose section |
A Don't was learned the hard way | Add a bullet to ## Do's and Don'ts capturing the rule + the why |
--var)When a DESIGN.md exists but you're not sure if it's current, run this audit (mental or scripted):
--clr- (or whatever the project's CSS-variable prefix is). Every distinct token should appear in colors:. Any with different values is drift; reconcile in favor of the runtime (the codebase ships; the doc describes).components.<name>: entry. Recent additions are usually the gap.changelog/ with entries describing visual-fix rounds, every "we tried X and it didn't work" should leave a trace in ## Do's and Don'ts. Otherwise you'll re-make the same mistake.A DESIGN.md describes a system; it doesn't implement one. The runtime CSS is what actually ships. So:
DESIGN.md. Don't try to "design in the doc" and then ask the user to implement what the doc says — the doc will read confidently but the runtime won't match.Always note the runtime source-of-truth path at the top of DESIGN.md in a blockquote:
> The runtime source of truth is `src/layouts/BaseLayout.astro`'s `:root` block.
> This document is the human- and agent-readable contract that explains intent.
> Keep the two in sync when either changes.The Stitch spec's "Consumer Behavior for Unknown Content" table guarantees:
| Scenario | Behavior |
|---|---|
| Unknown section heading | Preserve; do not error |
| Unknown frontmatter top-level key | Preserve |
| Unknown color / typography token name | Accept if value is valid |
| Unknown component property | Accept with warning |
So project-specific extensions are safe as long as you keep the standard sections in canonical order and don't break the YAML structure. Three known Lossless extensions:
| Extension | Lives in | Owned by skill |
|---|---|---|
imagery: block (Ideogram request recipe) | Frontmatter, after components:; ## Imagery prose section before ## Do's and Don'ts | generate-consistent-og-images |
modes: block (light/dark/vibrant variants) | Frontmatter; mode-specific overrides in ## Brand & Style or ## Colors | theme-system |
icons: / iconography: block (icon set, stroke conventions) | Frontmatter; prose under ## Shapes or a new section | (no skill yet — add when a project needs one) |
Rule for adding new extensions: the extension's frontmatter token block lives in the spec-compliant YAML; the extension's prose section uses an <h2> heading and slots in before ## Do's and Don'ts. Don't break the eight canonical sections — extend after them, not in the middle.
DESIGN.mdScenario: shipped a new <CtaButton> component. The DESIGN.md doesn't mention it yet.
<CtaButton> (3 variants — primary, ghost, link):cta-primary: gradient bg, dark text, mono typography, pill radius, 12px×22px paddingcta-ghost: translucent bg, light text, neutral bordercta-link: no bg, dim text components:
# ...existing entries...
cta-primary:
backgroundColor: "linear-gradient(120deg, {colors.primary}, {colors.primary-soft})"
textColor: "{colors.surface-base}"
typography: "{typography.mono-md}"
rounded: "{rounded.full}"
padding: "12px 22px"
cta-ghost:
backgroundColor: "rgba(255, 255, 255, 0.04)"
textColor: "{colors.on-surface}"
typography: "{typography.mono-md}"
rounded: "{rounded.full}"
padding: "12px 22px"
cta-link:
backgroundColor: transparent
textColor: "{colors.on-surface-dim}"
typography: "{typography.mono-md}"
padding: "12px 4px"## Components: ### CtaButton (the primary CTA)
Reusable primary action button. Three variants:
- **Primary:** Cyan→aquamarine gradient, dark text, pill-shaped.
- **Ghost:** Translucent surface; pairs with primary as secondary action.
- **Link:** No surface, dim text. Tertiary inline action.
Any card-scope override (e.g. tighter padding inside a card footer) is
documented in the scope's own subsection, not here.## Do's and Don'ts. E.g. "Don't keep the resting cyan glow shadow on the CTA when it lives inside a card footer — drop it; hover restores a softer version."--clr-cyan, the frontmatter should say colors.primary: "#04e5e5" and the prose should mention "the brand cyan" — i.e., both ends of the rename should be present. Renaming in the doc without grepping the code produces "ghost" tokens nobody can find.## Components, before ## Do's and Don'ts. Don't insert them at random positions.| Sibling skill | Relationship |
|---|---|
theme-system | Owns the architecture of the design system (two-tier tokens, three-mode contract, theme.css organization). This skill owns the document that describes that architecture. They compose: when you ship new theme work via theme-system, you maintain its DESIGN.md via this one. |
generate-consistent-og-images | Reads imagery: extension from DESIGN.md. If DESIGN.md is missing, that skill calls back into this one. |
astro-knots | Defines the family of sites that should each have a DESIGN.md. When scaffolding a new Astro Knots site via that skill, hand off to this one to author the first-pass DESIGN.md after Brand & Style is decided. |
open-graph-share-seo-geo | The delivery side of imagery (CDN host, headers, JPEG-over-WebP, the og:image:type invariant). Cares that imagery exists; doesn't care how it was generated. Composes with the imagery: extension owned by generate-consistent-og-images but documented in DESIGN.md. |
context-vigilance | Governs how we document in context-v/ (specs, blueprints, prompts, plans). DESIGN.md lives at the project root, not in context-v/, because it's product-facing — but the same discipline (sense-make first, mention the why, keep it current) applies. |
templates/design-md-scaffold.md — the canonical empty-file scaffold for a new DESIGN.md. Drop in, fill in the ★-marked fields, delete the placeholder values, author the prose.content-farm/splash/DESIGN.md — the canonical full-example, including the off-spec imagery: extension.examples/atmospheric-glass, examples/paws-and-paths, examples/totality-festival~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.