design-md — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited design-md (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
DESIGN.md is Google's open spec (Apache-2.0, google-labs-code/design.md) for describing a visual identity to coding agents. One file combines:
Tokens give exact values. Prose tells agents why those values exist and how to apply them. The CLI (npx @google/design.md) lints structure + WCAG contrast, diffs versions for regressions, and exports to Tailwind or W3C DTCG JSON.
For purely visual inspiration or layout examples, use popular-web-designs instead. For process and taste when designing a one-off HTML artifact from scratch (prototype, deck, landing page, component lab), use claude-design. This skill is for the formal spec file itself.
---
version: alpha
name: Heritage
description: Architectural minimalism meets journalistic gravitas.
colors:
primary: "#1A1C1E"
secondary: "#6C7278"
tertiary: "#B8422E"
neutral: "#F7F5F2"
typography:
h1:
fontFamily: Public Sans
fontSize: 3rem
fontWeight: 700
lineHeight: 1.1
letterSpacing: "-0.02em"
body-md:
fontFamily: Public Sans
fontSize: 1rem
rounded:
sm: 4px
md: 8px
lg: 16px
spacing:
sm: 8px
md: 16px
lg: 24px
components:
button-primary:
backgroundColor: "{colors.tertiary}"
textColor: "#FFFFFF"
rounded: "{rounded.sm}"
padding: 12px
button-primary-hover:
backgroundColor: "{colors.primary}"
---
## Overview
Architectural Minimalism meets Journalistic Gravitas...
## Colors
- **Primary (#1A1C1E):** Deep ink for headlines and core text.
- **Tertiary (#B8422E):** "Boston Clay" — the sole driver for interaction.
## Typography
Public Sans for everything except small all-caps labels...
## Components
`button-primary` is the only high-emphasis action on a page...| Type | Format | Example |
|---|---|---|
| Color | # + hex (sRGB) | "#1A1C1E" |
| Dimension | number + unit (px, em, rem) | 48px, -0.02em |
| Token reference | {path.to.token} | {colors.primary} |
| Typography | object with fontFamily, fontSize, fontWeight, lineHeight, letterSpacing, fontFeature, fontVariation | see above |
Component property whitelist: backgroundColor, textColor, typography, rounded, padding, size, height, width. Variants (hover, active, pressed) are separate component entries with related key names (button-primary-hover), not nested.
Sections are optional, but present ones MUST appear in this order. Duplicate headings reject the file.
Unknown sections are preserved, not errored. Unknown token names are accepted if the value type is valid. Unknown component properties produce a warning.
direction. If they provided a site, image, or vibe, translate it to the token shape above.
write_file. Alwaysinclude name: and colors:; other sections optional but encouraged.
{colors.primary}) in the components: sectioninstead of re-typing hex values. Keeps the palette single-source.
before returning.
exports next to the file (tailwind.theme.json, tokens.json).
The CLI is @google/design.md (Node). Use npx — no global install needed.
# Validate structure + token references + WCAG contrast
npx -y @google/design.md lint DESIGN.md
# Compare two versions, fail on regression (exit 1 = regression)
npx -y @google/design.md diff DESIGN.md DESIGN-v2.md
# Export to Tailwind theme JSON
npx -y @google/design.md export --format tailwind DESIGN.md > tailwind.theme.json
# Export to W3C DTCG (Design Tokens Format Module) JSON
npx -y @google/design.md export --format dtcg DESIGN.md > tokens.json
# Print the spec itself — useful when injecting into an agent prompt
npx -y @google/design.md spec --rules-only --format jsonAll commands accept - for stdin. lint returns exit 1 on errors. Use the --format json flag and parse the output if you need to report findings structurally.
broken-ref (error) — {colors.missing} points at a non-existent tokenduplicate-section (error) — same ## Heading appears twiceinvalid-color, invalid-dimension, invalid-typography (error)wcag-contrast (warning/info) — component textColor vs backgroundColorratio against WCAG AA (4.5:1) and AAA (7:1)
unknown-component-property (warning) — outside the whitelist aboveWhen the user cares about accessibility, call this out explicitly in your summary — WCAG findings are the most load-bearing reason to use the CLI.
button-primary.hover is wrong;button-primary-hover as a sibling key is right.
# ortruncate values like #1A1C1E oddly.
letterSpacing: -0.02em parses asa YAML flow — write letterSpacing: "-0.02em".
reorder it to match the canonical list before saving.
is marked alpha — watch for breaking changes.
{colors.primary} works;{primary} does not.
@google/design.md on npmthe spec itself is Apache-2.0.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.