Habilidades ckm-design
📦
ckm-design
v2.1.0 Revisión del contenido r1 Riesgo alto 📁 Acceso al sistema de archivos🔑 Variables de entorno🌐 Acceso a red⚙️ Comandos externos
Crear recursos completos de diseño de marca
Los equipos de diseño suelen necesitar muchos recursos de marca con estilos y formatos coherentes. Esta skill guía a Claude, Codex y Claude Code en la creación de logotipos, iconos, maquetas de identidad, banners, imágenes sociales y recursos para presentaciones.
Compatible con: Claude Codex Code(CC)
Detente y solicita confirmación antes de instalar.
Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "ckm-design" from https://skillstore.io/skills/nextlevelbuilder-ckm-design.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-ckm-design/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "ckm-design". Crear conceptos de logotipo para una aplicación de viajes ecológicos.
Resultado esperado:
- Tres direcciones de logotipo con diferentes estados visuales.
- Colores y tipografía recomendados.
- Orientación sobre iconos y símbolos para uso en la aplicación.
Usando "ckm-design". Planificar gráficos de lanzamiento para LinkedIn e Instagram para un producto SaaS.
Resultado esperado:
- Dimensiones específicas por plataforma.
- Recomendaciones de maquetación y jerarquía del texto.
- Lista de verificación de exportación para la revisión de imágenes.
Usando "ckm-design". Crear un concepto de CIP para una marca de consultoría.
Resultado esperado:
- Entregables de identidad sugeridos.
- Escenas de maqueta y notas de uso.
- Estructura de presentación para revisión con el cliente.
Auditoría de seguridad
Riesgo altov5 • 9/7/2026 Abrir el informe versionado
The audit found no evidence of malware, prompt-injection text, or covert host reconnaissance. Most static hits are false positives from Markdown examples and design terminology, but the skill does read environment variables, loads .env files from user-home locations, writes generated files, and sends design inputs to Gemini APIs.
35
Archivos escaneados
5,279
Líneas analizadas
28
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (14)
Alto
Environment file access
"""Load environment variables from .env files"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
"""Load .env files in priority order"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Mostrar los 14 problemas confirmados
Alto
Environment file access
"""Load .env files in priority order"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Alto
Third-party AI API processing of user design inputs
The logo, CIP, and icon generators initialize Gemini clients with local API keys. User prompts, brand details, logos, or generated assets may be sent to a third-party AI service as part of normal operation.
The static findings show Gemini client initialization with environment API keys in all three generators. The skill purpose is image and design generation, so user design inputs are likely processed externally.
Medio
Workflow encourages external browsing and tool delegation
The banner and social workflow instructs the assistant to browse Pinterest and invoke external design or browser tooling. This can disclose user-provided campaign details or brand assets outside the local environment.
The referenced workflow text explicitly includes browsing and tool delegation steps. The risk depends on user content, but the instruction is clear and not captured by simple static URL matching.
Elementos de revisión de capacidades (28)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Generic API/secret keys
api_key = os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Alto
Generic API/secret keys
client = genai.Client(api_key=api_key)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Alto
Generic API/secret keys
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Alto
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Alto
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Alto
Generic API/secret keys
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Alto
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Medio
Python file write/append
with open(filepath, "wb") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medio
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medio
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medio
Python file write/append
with open(filepath, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medio
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Medio
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Medio
Python file write/append
with open(output_path, "wb") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medio
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Bajo
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Bajo
Hardcoded URL
<div class="slide slide-with-bg" style="background-image: url('https://images.pexels.com/...')">
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Bajo
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family={FONT}&display=swap" rel="stylesheet">
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Bajo
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
api_key = os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Python environment access
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Bajo
Hardcoded URL
export GEMINI_API_KEY="your-key" # https://aistudio.google.com/apikey
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Factores de riesgo
📁 Acceso al sistema de archivos (50)
references/cip-design.md:19 references/cip-design.md:26 references/cip-design.md:29 references/cip-design.md:32 references/cip-design.md:35 references/cip-design.md:42 references/cip-design.md:45 references/cip-design.md:48 references/cip-design.md:51 references/cip-design.md:54 references/cip-design.md:60 references/cip-design.md:61 references/cip-design.md:19 references/cip-design.md:26 references/cip-design.md:29 references/cip-design.md:32 references/cip-design.md:35 references/cip-design.md:42 references/cip-design.md:45 references/cip-design.md:48 references/cip-design.md:51 references/cip-design.md:54 references/cip-design.md:60 references/cip-design.md:61 references/icon-design.md:16 references/icon-design.md:17 references/icon-design.md:18 references/icon-design.md:24 references/icon-design.md:25 references/icon-design.md:31 references/icon-design.md:37 references/icon-design.md:38 references/icon-design.md:16 references/icon-design.md:17 references/icon-design.md:18 references/icon-design.md:24 references/icon-design.md:25 references/icon-design.md:31 references/icon-design.md:37 references/icon-design.md:38 references/logo-design.md:18 references/logo-design.md:25 references/logo-design.md:28 references/logo-design.md:31 references/logo-design.md:39 references/logo-design.md:40 references/logo-design.md:18 references/logo-design.md:25 references/logo-design.md:28 references/logo-design.md:31
🔑 Variables de entorno (30)
references/cip-design.md:119 references/icon-design.md:120 references/logo-design.md:90 scripts/cip/generate.py:83 scripts/cip/generate.py:84 scripts/cip/generate.py:212 scripts/cip/generate.py:212 scripts/cip/generate.py:213 scripts/cip/generate.py:214 scripts/cip/generate.py:217 scripts/icon/generate.py:41 scripts/icon/generate.py:42 scripts/icon/generate.py:56 scripts/icon/generate.py:56 scripts/icon/generate.py:193 scripts/icon/generate.py:194 scripts/icon/generate.py:195 scripts/icon/generate.py:198 scripts/icon/generate.py:290 scripts/icon/generate.py:291 scripts/icon/generate.py:294 scripts/logo/generate.py:44 scripts/logo/generate.py:45 scripts/logo/generate.py:59 scripts/logo/generate.py:59 scripts/logo/generate.py:145 scripts/logo/generate.py:146 scripts/logo/generate.py:147 scripts/logo/generate.py:151 SKILL.md:295
🌐 Acceso a red (4)
⚙️ Comandos externos (50)
references/social-photos-design.md:170-181 references/social-photos-design.md:196-207 references/social-photos-design.md:138 scripts/icon/generate.py:110 scripts/icon/generate.py:124 scripts/icon/generate.py:132-133 scripts/icon/generate.py:133 scripts/icon/generate.py:138-140 scripts/icon/generate.py:140 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:33 SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:46-48 SKILL.md:48-52 SKILL.md:52-56 SKILL.md:56-62 SKILL.md:62-65 SKILL.md:65-69 SKILL.md:69 SKILL.md:77-79 SKILL.md:79-83 SKILL.md:83-88 SKILL.md:88-92 SKILL.md:92-104 SKILL.md:104-106 SKILL.md:106 SKILL.md:110-112 SKILL.md:112-120 SKILL.md:120-126 SKILL.md:126-127 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-134 SKILL.md:134 SKILL.md:136-140 SKILL.md:140-141 SKILL.md:141-142 SKILL.md:142 SKILL.md:143-185 SKILL.md:185-189 SKILL.md:189-193 SKILL.md:193-195 SKILL.md:195-199
Auditado por: claude Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/nextlevelbuilder-ckm-design?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/nextlevelbuilder-ckm-design?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-ckm-design/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-ckm-design.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
nextlevelbuilder. (2026). ckm-design security audit report (audit version 5) [Author version 2.1.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5Cita BibTeX
@techreport{nextlevelbuilder-nextlevelbuilder-ckm-design-2026,
author = {nextlevelbuilder},
title = {ckm-design security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5},
note = {Author version 2.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ckm-design security audit report (audit version 5)"
version: "2.1.0"
type: report
authors:
- name: "nextlevelbuilder"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5"
identifiers:
- type: other
value: "skillstore:nextlevelbuilder-ckm-design:audit:5"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Alto 68
Arquitectura
100
Mantenibilidad
87
Contenido
67
Comunidad
91
Cumplimiento de la especificación
Lo que puedes crear
Lanzar un kit de marca para una startup
Crear direcciones de logotipo, opciones de color, ideas de iconos y primeros elementos visuales de presentación para una nueva empresa.
Producir recursos sociales para una campaña
Planificar imágenes sociales, banners y encabezados específicos por plataforma con dimensiones y dirección visual coherentes.
Crear maquetas de identidad para clientes
Generar conceptos de entregables de identidad corporativa como tarjetas de presentación, membretes, empaques y maquetas de presentación.
Prueba estos prompts
Crear una dirección simple de logotipo
Use ckm-design to propose three logo directions for a small coffee shop named Harbor Bean. Include style, color palette, and icon idea for each direction.
Diseñar un conjunto de campaña social
Use ckm-design to plan social media images for a product launch on LinkedIn, Instagram, and X. Include dimensions, layout approach, copy hierarchy, and visual style.
Crear maquetas de identidad corporativa
Use ckm-design to create a corporate identity program for a healthcare analytics company. Recommend deliverables, mockup contexts, typography style, and color usage.
Generar un sistema de marca integrado
Use ckm-design to define a brand system for a B2B AI platform, then plan logo variants, icon style, presentation structure, banner assets, and social image templates.
Mejores prácticas
- Proporcione el nombre de la marca, público objetivo, industria, tono y formatos requeridos antes de la generación.
- Revise todos los recursos generados para verificar derechos de autor, accesibilidad y precisión de marca antes de publicarlos.
- Use una carpeta de salida dedicada y confirme antes de enviar materiales confidenciales de clientes a servicios externos de AI.
Evitar
- No use logotipos generados como marcas comerciales finales sin revisión legal y de originalidad.
- No coloque claves de API ni secretos de clientes directamente en prompts, Markdown o archivos compartidos.
- No ejecute scripts de generación sobre rutas amplias del directorio de inicio ni ubicaciones de salida no confiables.
Preguntas frecuentes
¿Esta skill crea recursos de marca terminados?
Puede generar recursos preliminares sólidos y direcciones de diseño estructuradas. Un diseñador humano debe revisar y finalizar el trabajo de marca importante.
¿Requiere Gemini?
Algunos scripts de generación de logotipos, iconos y maquetas requieren una clave de API de Gemini o Google. Los flujos de trabajo solo de referencia aún pueden guiar el diseño sin generación.
¿Puede crear recursos para múltiples plataformas sociales?
Sí. Incluye orientación para dimensiones comunes de plataformas, patrones de maquetación y consideraciones de exportación para gráficos sociales y banners.
¿Es seguro para marcas confidenciales de clientes?
Use precaución. Los flujos de trabajo con Gemini pueden enviar prompts, detalles de marca o recursos a un servicio externo de AI, así que obtenga aprobación primero.
¿Qué herramientas funcionan con esta skill?
El informe enumera Claude, Codex y Claude Code como herramientas compatibles para flujos de trabajo de diseño guiado.
¿Qué debo revisar antes de publicar los resultados?
Revise accesibilidad, tamaños de plataforma, riesgo de derechos de autor, riesgo de marca comercial y si el recurso coincide con la voz de marca prevista.
Detalles del desarrollador
Autor
nextlevelbuilderLicencia
MIT
Versión del autor
v2.1.0
Revisión de Skillstore
r1
Repositorio
https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/tree/main/.claude/skills/design/Ref.
1ffa7643651792ccb4bd3b15d924d2c97edff755
Actualidad del mantenimiento
18/7/2026
Uso
10 descargas · 9 vistas