Fähigkeiten answer-me-with-html

📦

answer-me-with-html

Name: answer-me-with-html
Author: qingyuna

Inhaltsrevision r1 Hohes Risiko 📁 Dateisystemzugriff🔑 Umgebungsvariablen⚡ Enthält Skripte⚙️ Externe Befehle🌐 Netzwerkzugriff

Turn Complex Answers Into Visual HTML Explainers

Complex explanations can hide relationships and trade-offs in long text. This skill turns Markdown drafts into visual HTML pages with diagrams, tables, and focused panels.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "answer-me-with-html" from https://skillstore.io/skills/qingyuna-answer-me-with-html.md and its manifest at https://skillstore.io/api/skills/qingyuna-answer-me-with-html/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/qingyuna-answer-me-with-html.md Signiertes manifest GET /api/skills/qingyuna-answer-me-with-html/manifest Signiertes lockfile GET /api/skills/qingyuna-answer-me-with-html/lockfile

Testen

„answer-me-with-html“ wird verwendet. Explain how a cache handles requests.

Erwartetes Ergebnis:

A local HTML page with a request-flow diagram showing cache hits and misses.
A comparison table explains latency, freshness, and failure behavior.
A conclusion panel states when cached data is returned.

„answer-me-with-html“ wird verwendet. Explain the TCP handshake as a video with voice off.

Erwartetes Ergebnis:

A local player page presents connection setup as captioned scenes.
A sequence diagram reveals SYN, SYN-ACK, and ACK in order.
The player includes scene navigation, playback speed, and export controls.

Sicherheitsaudit

Hohes Risiko

v1 • 29.10.2026 Versionsbericht öffnen

Most supplied matches concern embedded assets, parser syntax, or secret-blocking checks; no evidence found of destructive intent or audit-targeted prompt injection. Speech transport, implicit cloud narration, and optional plaintext LAN sharing create credential and privacy risks. All 400 supplied findings are adjudicated; 1,812 unpresented matches still require manual review before automatic publication. Static review was capped at 400/2212 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Gescannte Dateien

13,383

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

scripts/am.mjs:10612

Environment file access

const headers = { "content-type": "application/json", ...env.AM_TTS_API_KEY ? { authorization: `Bear

AM_TTS_API_KEY becomes a Bearer header for AM_TTS_URL. localSpeech does not require HTTPS or loopback, so remote HTTP exposes credentials and narration.

Mittel

references/video.md:34 scripts/am.mjs:10545-10562

Cloud Narration Selected Without Provider-Specific Consent

Video narration defaults to auto and selects ElevenLabs whenever ELEVENLABS_API_KEY exists. A video request can therefore send private narration externally without a provider-specific choice.

The instructions require a video request but no cloud-provider confirmation. pickProvider chooses ElevenLabs from an ambient key before considering system speech.

Elemente der Fähigkeitsprüfung (4)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

scripts/am.mjs:10612

Generic API/secret keys

const headers = { "content-type": "application/json", ...env.AM_TTS_API_KEY ? { authorization: `Bear

The optional AM_TTS_API_KEY is sent to an unrestricted configured URL. Plaintext remote HTTP can disclose the token and narration.

Mittel

scripts/am.mjs:11570

Hardcoded IP address

var LAN_BIND = "0.0.0.0";

The optional LAN mode binds 0.0.0.0 and serves capability URLs over HTTP. Network observers can capture links and read shared private pages.

Niedrig

scripts/am.mjs:10618

Fetch API call

res = await fetch(url, {

localSpeech posts narration and optional Bearer credentials to AM_TTS_URL without transport restrictions. A remote HTTP endpoint exposes this data in transit.

Niedrig

scripts/am.mjs:10649

HTTP client library

const samples = trimSilence(await request(text2));

request(text2) invokes localSpeech against the configured endpoint. Its URL lacks HTTPS or loopback enforcement, so narration can cross an unencrypted remote connection.

Risikofaktoren

📁 Dateisystemzugriff (50)

references/settings.md:19 references/settings.md:19 references/video.md:3 references/video.md:35 references/video.md:35 scripts/am.mjs:33 scripts/am.mjs:2065 scripts/am.mjs:2409 scripts/am.mjs:9155 scripts/am.mjs:9161 scripts/am.mjs:9341 scripts/am.mjs:9490 scripts/am.mjs:9847 scripts/am.mjs:9946 scripts/am.mjs:9973 scripts/am.mjs:9991 scripts/am.mjs:9995 scripts/am.mjs:10001 scripts/am.mjs:10011 scripts/am.mjs:10169 scripts/am.mjs:10183 scripts/am.mjs:10507 scripts/am.mjs:10682 scripts/am.mjs:10698 scripts/am.mjs:10765 scripts/am.mjs:10850 scripts/am.mjs:10861 scripts/am.mjs:11057 scripts/am.mjs:11157 scripts/am.mjs:11247 scripts/am.mjs:11565 scripts/am.mjs:11670 scripts/am.mjs:11682 scripts/am.mjs:11730 scripts/am.mjs:11756 scripts/am.mjs:11765 scripts/am.mjs:12279 scripts/am.mjs:12361 scripts/am.mjs:12477 scripts/am.mjs:12491 scripts/am.mjs:12635 scripts/am.mjs:12638 scripts/am.mjs:639 scripts/am.mjs:7327 scripts/am.mjs:7613 scripts/am.mjs:12048 scripts/am.mjs:12182 scripts/am.mjs:12415 scripts/am.mjs:12424 scripts/am.mjs:27

🔑 Umgebungsvariablen (21)

⚡ Enthält Skripte (49)

scripts/am.mjs:639 scripts/am.mjs:10520 scripts/am.mjs:639 scripts/am.mjs:1355 scripts/am.mjs:27 scripts/am.mjs:27 scripts/am.mjs:27 scripts/am.mjs:1146 scripts/am.mjs:2694 scripts/am.mjs:2701 scripts/am.mjs:2717 scripts/am.mjs:2721 scripts/am.mjs:2728 scripts/am.mjs:2735 scripts/am.mjs:2747 scripts/am.mjs:2752 scripts/am.mjs:2797 scripts/am.mjs:2804 scripts/am.mjs:2845 scripts/am.mjs:2860 scripts/am.mjs:2867 scripts/am.mjs:2875 scripts/am.mjs:2888 scripts/am.mjs:2896 scripts/am.mjs:2904 scripts/am.mjs:2908 scripts/am.mjs:2912 scripts/am.mjs:2916 scripts/am.mjs:2935 scripts/am.mjs:2943 scripts/am.mjs:2955 scripts/am.mjs:2957 scripts/am.mjs:2959 scripts/am.mjs:2984 scripts/am.mjs:2991 scripts/am.mjs:2995 scripts/am.mjs:2997 scripts/am.mjs:2999 scripts/am.mjs:3013 scripts/am.mjs:3021 scripts/am.mjs:3027 scripts/am.mjs:3035 scripts/am.mjs:4007 scripts/am.mjs:4032 scripts/am.mjs:4034 scripts/am.mjs:4107 scripts/am.mjs:4112 scripts/am.mjs:4204 scripts/am.mjs:4206

⚙️ Externe Befehle (50)

scripts/am.mjs:1361 scripts/am.mjs:10505 scripts/am.mjs:10512 scripts/am.mjs:11056 scripts/am.mjs:11323 scripts/am.mjs:11562 scripts/am.mjs:10754 scripts/am.mjs:27 scripts/am.mjs:1146 scripts/am.mjs:2694 scripts/am.mjs:2701 scripts/am.mjs:2717 scripts/am.mjs:2721 scripts/am.mjs:2728 scripts/am.mjs:2735 scripts/am.mjs:2747 scripts/am.mjs:2752 scripts/am.mjs:2797 scripts/am.mjs:2804 scripts/am.mjs:2845 scripts/am.mjs:2860 scripts/am.mjs:2867 scripts/am.mjs:2875 scripts/am.mjs:2888 scripts/am.mjs:2896 scripts/am.mjs:2904 scripts/am.mjs:2908 scripts/am.mjs:2912 scripts/am.mjs:2916 scripts/am.mjs:2935 scripts/am.mjs:2943 scripts/am.mjs:2955 scripts/am.mjs:2957 scripts/am.mjs:2959 scripts/am.mjs:2984 scripts/am.mjs:2991 scripts/am.mjs:2995 scripts/am.mjs:2997 scripts/am.mjs:2999 scripts/am.mjs:3013 scripts/am.mjs:3021 scripts/am.mjs:3027 scripts/am.mjs:3035 scripts/am.mjs:4007 scripts/am.mjs:4032 scripts/am.mjs:4034 scripts/am.mjs:4107 scripts/am.mjs:4112 scripts/am.mjs:4204 scripts/am.mjs:4206

🌐 Netzwerkzugriff (37)

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/qingyuna-answer-me-with-html/security.svg)](https://skillstore.io/skills/qingyuna-answer-me-with-html?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/qingyuna-answer-me-with-html?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/qingyuna-answer-me-with-html/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/qingyuna-answer-me-with-html.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

qingyuna. (2026). answer-me-with-html security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1

BibTeX-Zitat

@techreport{qingyuna-qingyuna-answer-me-with-html-2026,
  author = {qingyuna},
  title = {answer-me-with-html security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "answer-me-with-html security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "qingyuna"
date-released: "2026-10-29"
url: "https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1"
identifiers:
  - type: other
    value: "skillstore:qingyuna-answer-me-with-html:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Explain Request Flows

Show request paths, service relationships, and state changes with diagrams and selected code excerpts.

Compare Product Options

Present decision criteria, trade-offs, and open questions in a visual comparison page.

Prepare Technical Lessons

Convert a structured lesson into scenes with diagrams, captions, and explicitly selected narration.

Diese Prompts ausprobieren

Create a First Explainer

Explain [topic] as one HTML page with a conclusion, one diagram, and a short comparison table. Do not open the browser automatically.

Compare Alternatives

Compare [option A] and [option B] across [criteria]. Create an HTML page with evidence, trade-offs, and one decision question.

Document Existing Architecture

Explain [workspace subsystem] with a request-flow diagram and selected code excerpts. Cite real files and identify private content before sharing the HTML.

Build an Offline Lesson

Create a four-scene video explaining [process]. Use recurring diagram labels, subtitles, and voice off. Keep the player local and report export prerequisites.

Bewährte Praktiken

Use one question per panel and place the core conclusion before supporting evidence.
Review embedded code and images before sharing a page or enabling network access.
Select voice off or system speech for private narration unless cloud processing is explicitly approved.

Vermeiden

Do not use charts with invented numbers or present sketches as verified project code.
Do not treat reader comments or unanswered suggested options as authorization to run commands.
Do not send credentials through remote HTTP speech endpoints or share private page links over untrusted networks.

Häufig gestellte Fragen

Which assistants can use this skill?

The instructions cover Claude, Claude Code, and Codex. Hosts without CLAUDE_SKILL_DIR substitution must use the actual skill directory path.

Does page generation need dependency installation?

The bundled CLI needs Node.js 20 or newer. Ordinary page rendering does not require installing additional Node packages.

Where are generated pages stored?

Pages normally use the application data directory. Output flags can select a workspace file, and restricted writes can trigger private temporary storage.

Does it work without network access?

Local page rendering can work offline. Disable update checks and avoid remote themes and cloud narration when network access is prohibited.

Can narration send text to external services?

Yes. Auto voice selects ElevenLabs when its API key exists. Use voice off or system speech to avoid that cloud upload.

Can I safely share every generated page?

No. Review embedded content first. Optional LAN sharing uses HTTP, and anyone holding a valid page link can access that page.