スキル hairline-create

📦

hairline-create

Name: hairline-create
Author: lucasmarkes

コンテンツリビジョン r1 中リスク ⚙️ 外部コマンド⚡ スクリプトを含む📁 ファイルシステムへのアクセス🔑 環境変数🌐 ネットワークアクセス

Create Interactive Hairline Figures

Interactive line illustrations require consistent geometry, motion, and visual checks. This skill guides concept selection, builds a standalone HTML figure, and checks its structure and appearance.

対応: Claude Codex Code(CC)

📊 70 十分

Maintain this Skill? Claim it 📊 70 十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "hairline-create" from https://skillstore.io/skills/lucasmarkes-hairline-create.md and its manifest at https://skillstore.io/api/skills/lucasmarkes-hairline-create/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/lucasmarkes-hairline-create.md 署名済み manifest GET /api/skills/lucasmarkes-hairline-create/manifest 署名済み lockfile GET /api/skills/lucasmarkes-hairline-create/lockfile

テストする

「hairline-create」を使用しています。 Suggest a Hairline metaphor for a deployment pipeline.

期待される結果:

Locks: stepped canal basins open in sequence from the selected lock; the readout names its stage.
Marble run: hovering slows rolling marbles so the selected ramp can be inspected.
Cabinet: nearby server blades slide outward as the pointer selects an update position.

「hairline-create」を使用しています。 Build the supplied Riffle example and describe its interaction.

期待される結果:

A standalone HTML page shows eight cards in a rounded tray. The selected card rises, neighboring cards lean away, and the slider controls stagger timing.

「hairline-create」を使用しています。 Describe the visual inspection deliverables for a completed figure.

期待される結果:

A labeled PNG sheet compares eight states, including thumbnails, slider extremes, and dark and light themes.
The inspection reports frame bounds, readouts, console messages, and settling observations.
Unverified visual checks are disclosed when no browser is available.

セキュリティ監査

中リスク

v1 • 2026/10/4 バージョン別レポートを開く

Most static matches are benign JavaScript syntax, documentation, CSS, or intended local file operations. Automatic npm installation exposes the host to mutable dependencies and enabled lifecycle scripts, while browser inspection lacks network isolation. No evidence found of credential theft, malicious supplied figures, or audit-directed prompt injection.

スキャンされたファイル

1,859

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (1)

中

validate.mjs:89-93 look.mjs:111-112 look.mjs:133-138

Browser Inspection Lacks Network Isolation

The validator rejects literal API names, but does not establish a security boundary for JavaScript. Accepted figures execute without network blocking, so computed API access can reach external or local network services.

Source inspection shows regex-based API rejection and page navigation without request blocking. No evidence found of actual exfiltration or malicious supplied figures.

機能レビュー項目 (2)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

look.mjs:26

Node.js child_process module

import { spawnSync } from "node:child_process";

The imported spawnSync is used at line 78 for automatic npm installation. Mutable dependency resolution and enabled lifecycle scripts expose the host to supply-chain execution.

高

look.mjs:78

Synchronous spawn

const run = spawnSync(win ? "npm.cmd" : "npm", ["install", "playwright-core@1", "--prefix", dir, "--

spawnSync automatically installs playwright-core@1 without disabling npm lifecycle scripts. A compromised dependency or existing cache manifest can execute host commands during installation.

リスク要因

⚙️ 外部コマンド (50)

⚡ スクリプトを含む (9)

build.mjs:25 look.mjs:79 look.mjs:179 validate.mjs:138 validate.mjs:142 validate.mjs:166 validate.mjs:167 validate.mjs:180 validate.mjs:185

📁 ファイルシステムへのアクセス (28)

🔑 環境変数 (1)

look.mjs:56

🌐 ネットワークアクセス (1)

validate.mjs:89

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/lucasmarkes-hairline-create/security.svg)](https://skillstore.io/skills/lucasmarkes-hairline-create?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/lucasmarkes-hairline-create?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lucasmarkes-hairline-create/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/lucasmarkes-hairline-create.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

lucasmarkes. (2026). hairline-create security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1

BibTeX形式の引用

@techreport{lucasmarkes-lucasmarkes-hairline-create-2026,
  author = {lucasmarkes},
  title = {hairline-create security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "hairline-create security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "lucasmarkes"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1"
identifiers:
  - type: other
    value: "skillstore:lucasmarkes-hairline-create:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Prototype a Pointer Interaction

Explore how a tray, stack, or field responds to pointer movement before adapting the interaction to a product.

Build a Shareable Illustration

Create a standalone HTML line figure with theme switching, an intensity slider, and no runtime external assets.

Explain a Process Through an Object

Translate a process into a recognizable physical metaphor with one gesture and a short readout.

これらのプロンプトを試す

Choose a Concept

Suggest three Hairline concepts for [idea]. Describe each object, pointer response, and short readout. Wait for my choice before building.

Create a Figure

Create a Hairline figure of [object] that [pointer action]. Use the supplied engine and page, then validate the HTML. Ask before installing dependencies.

Inspect Every State

Inspect [figure file] using [answer point] and [edge points]. Capture the eight views, report failures, and inspect the sheet. Ask before installing dependencies.

Refine Without Changing the Engine

Refine [figure file] to [requested change]. Edit only the figure, preserve stable hit areas, rerun validation, and disclose unverified checks. Ask before installing dependencies.

ベストプラクティス

Choose one recognizable object, one pointer gesture, and a composed rest pose before writing the figure.
Keep the engine and page unchanged, and review dependency installation before running browser inspection.
Validate after every edit, inspect all eight views, and disclose any checks that could not be performed.

回避

Modify the engine or page template to work around a figure problem.
Add labels, icons, custom colors, or independent animation timers inside the drawing.
Treat a passing text validator as proof of visual quality or security isolation.