fragments-govern

Pass

Audited by Gen Agent Trust Hub on Mar 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local shell commands to perform its functions.
  • Runs npx fragments govern check and npx fragments govern status to perform design audits.
  • Uses git diff to identify uncommitted or staged UI files (TSX, JSX, Vue, Svelte) for targeted reviews.
  • [EXTERNAL_DOWNLOADS]: Uses npx to execute the Fragments governance tool.
  • The tool @fragments-sdk/govern is a vendor-owned resource provided by the skill author.
  • Commands include a --cloud flag, indicating that metadata or analysis results are sent to the Fragments cloud service as part of the tool's intended design.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of local source code and JSON tool outputs.
  • Ingestion points: Git diff output (source code files) and JSON results from the fragments govern command.
  • Boundary markers: The skill logic specifies parsing JSON and identifying specific patterns (tokens, accessibility attributes).
  • Capability inventory: Execution of shell commands via npx and git.
  • Sanitization: The skill focuses on identifying specific design violations based on structured tool output.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 5, 2026, 05:56 PM