📩

design

v2.1.0 RĂ©vision du contenu r1 Risque moyen 🔑 Variables d’environnement📁 AccĂšs au systĂšme de fichiers🌐 AccĂšs rĂ©seau⚙ Commandes externes

Create Logos, Icons, Mockups, and Presentations

Creating consistent visual assets across formats requires repeated research and setup. This skill combines searchable design references, asset generators, and HTML workflows.

Prend en charge: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠ 50 MĂ©diocre

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent
Review the Skillstore skill "design" from https://skillstore.io/skills/nextlevelbuilder-design.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-design/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Tester

Utilisation de « design ». Recommend a logo direction for a technology consultancy without using an API.

Résultat attendu:

  • Direction: a minimalist geometric mark with a restrained blue and teal palette.
  • Typography: a clear sans-serif with strong readability at small sizes.
  • Next review: compare the mark in monochrome and on a business card.

Utilisation de « design ». Prepare a business card mockup presentation using an approved logo.

Résultat attendu:

  • Mockup concept: a white business card with the supplied logo and restrained brand accents.
  • Presentation structure: brand overview, mockup image, intended use, and material guidance.
  • Review notes: verify logo accuracy, contact text, image format, and presentation rendering.

Utilisation de « design ». Plan a coordinated Instagram post and story for a product announcement.

Résultat attendu:

  • Post layout: 1080 by 1080 pixels with the product image, announcement headline, and one call to action.
  • Story layout: 1080 by 1920 pixels with important text inside the central safe area.
  • Export status: deliver HTML first when browser capture is unavailable; PNG export remains pending.

Audit de sécurité

Risque moyen
v1 ‱ 26/10/2026 Ouvrir le rapport versionnĂ©

Most static findings are benign documentation, design terminology, mocked tests, or expected credential configuration. Confirmed findings expose API keys through unrestricted polling destinations and cross-origin redirects. Semantic findings identify incomplete DNS checks, unsanitized SVG and HTML output, and disabled browser sandboxing; no evidence found of deliberate prompt injection.

38
Fichiers analysés
6,617
Lignes analysées
7
ÉlĂ©ments Ă  examiner
0
Faux positifs ignorés

Préoccupations de sécurité confirmées (4)

Moyen
DNS Resolution Bypasses Private Address Checks
URL validation rejects literal private IP addresses but accepts unresolved hostnames. A provider-controlled hostname resolving internally can bypass the intended network boundary.
Nonliteral hostnames return before any DNS address check. Exploitation requires a suitable HTTPS endpoint and a malicious or compromised provider response.
Moyen
Generated SVG Is Saved Without Active Content Filtering
SVG extraction checks text structure but preserves scripts, event handlers, and external references. Malicious generated markup can execute when opened directly or embedded inline.
The extraction and save path contains no SVG element or attribute allowlist. Prompt instructions against external references do not enforce output safety.
Moyen
Presentation Labels Are Interpolated Without HTML Escaping
Brand names and filename-derived labels enter HTML text and attributes without escaping. Crafted input can inject markup or scripts when the presentation is opened.
Python f-strings insert input directly into the title, image attributes, and headings. Exploitation requires crafted labels and opening the generated document.
Moyen
Screenshot Workflow Disables Browser Sandboxing
The recommended Chrome command includes --no-sandbox while rendering HTML that may load external resources. This removes browser containment during screenshot export.
The documented command explicitly disables the Chrome sandbox without an isolation requirement. This increases compromise impact if rendered content exploits a browser vulnerability.
ÉlĂ©ments d’évaluation des capacitĂ©s (7)

Il s’agit de capacitĂ©s locales rĂ©elles qui peuvent ĂȘtre attendues pour cette compĂ©tence ; elles nĂ©cessitent donc un examen, mais ne sont pas comptabilisĂ©es comme comportement malveillant confirmĂ©.

ÉlevĂ©
HTTP client library
def redirect_request(self, req, fp, code, msg, headers, newurl):
The redirect handler accepts unrelated HTTPS origins without removing authentication headers. A provider redirect can therefore disclose the API key to another host.
ÉlevĂ©
HTTP client library
return super().redirect_request(req, fp, code, msg, headers, newurl)
The superclass redirect implementation copies authentication headers across origins. An offline standard-library check confirmed that x-api-key survives an HTTPS cross-host redirect.
ÉlevĂ©
HTTP client library
def _json_request(
The request helper attaches credentials without restricting the destination origin. Its MuAPI caller supplies a response-controlled polling URL, enabling credential disclosure.
ÉlevĂ©
HTTP client library
data = _json_request(
Polling sends x-api-key to result_url from the provider response. HTTPS validation does not restrict that URL to the MuAPI origin.
ÉlevĂ©
Generic API/secret keys
api_key_header: auth_value,
This header attaches the API key to a URL without checking its provider origin. Response-controlled polling URLs can receive that credential.
ÉlevĂ©
Generic API/secret keys
api_key,
The MuAPI key is passed to polling requests for a response-controlled URL. No same-origin check prevents sending the key to another HTTPS host.
ÉlevĂ©
Generic API/secret keys
api_key_header="x-api-key",
The x-api-key header is explicitly enabled for the response-controlled polling URL. Arbitrary HTTPS destinations pass validation and can receive the credential.

Facteurs de risque

🔑 Variables d’environnement (50)
📁 Accùs au systùme de fichiers (25)
🌐 AccĂšs rĂ©seau (33)
⚙ Commandes externes (50)
Audité par: codex
Partager et citer ce rapport

Partagez le rapport d’évaluation versionnĂ©, le badge neutre, la carte intĂ©grable et les citations. Skillstore prĂ©sente les preuves sans dĂ©cider si ce Skill est sĂ»r.

Ouvrir le rapport versionné
Évaluation de sĂ©curitĂ©

Copier le lien du rapport

https://skillstore.io/skills/nextlevelbuilder-design/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/nextlevelbuilder-design/security.svg)](https://skillstore.io/skills/nextlevelbuilder-design?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/nextlevelbuilder-design?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-design/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-design.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citations académiques (APA · BibTeX · CFF)

Citation APA

nextlevelbuilder. (2026). design security audit report (audit version 1) [Author version 2.1.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-design/audits/1

Citation BibTeX

@techreport{nextlevelbuilder-nextlevelbuilder-design-2026, author = {nextlevelbuilder}, title = {design security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/nextlevelbuilder-design/audits/1}, note = {Author version 2.1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "design security audit report (audit version 1)" version: "2.1.0" type: report authors: - name: "nextlevelbuilder" date-released: "2026-10-26" url: "https://skillstore.io/skills/nextlevelbuilder-design/audits/1" identifiers: - type: other value: "skillstore:nextlevelbuilder-design:audit:1" description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen
68
Architecture
100
Maintenabilité
87
Contenu
65
Communauté
91
Conformité aux spécifications

Ce que vous pouvez créer

Explore a Startup Identity

Compare logo directions and create business card or signage mockups before committing to a brand identity.

Prepare a Multi-Platform Campaign

Develop coordinated banner and social image concepts at platform-specific dimensions, then export approved layouts when browser capture is available.

Prototype Interface Icons

Generate SVG icon variations with consistent styling, colors, and display sizes for review before application integration.

Essayez ces prompts

Find a Logo Direction
Search local logo references for [brand] in [industry]. Recommend three styles and a palette with reasons. Do not call external APIs.
Generate Logo Concepts
Create three white-background logo concepts for [brand] using [provider] and [style]. Confirm API usage and costs first. Save approved outputs in [directory].
Build an Identity Presentation
Use [logo image] to create business card, letterhead, and signage mockups for [brand]. Confirm external uploads first. Build an HTML presentation from PNG outputs.
Coordinate a Campaign Asset Set
Plan coordinated LinkedIn, Instagram post, and story assets for [campaign]. Apply [brand guidelines] and [approved assets]. Check sibling skills and browser availability before proceeding. Present concepts before rendering. Review generated HTML and SVG before previewing. Report export dimensions and pending work.

Bonnes pratiques

  • Provide approved brand guidelines, target platforms, exact dimensions, and a dedicated output directory before generation.
  • Approve provider requests and logo uploads explicitly; use dedicated API credentials and avoid confidential material.
  • Review generated HTML and SVG before opening; verify image dimensions, text accuracy, contrast, and safe zones before delivery.

Éviter

  • Treating generated logos or mockups as final trademark clearance or print-ready production artwork.
  • Assuming sibling skills, provider credentials, or screenshot tools are installed without checking.
  • Opening unreviewed generated markup or sending confidential brand assets to external providers without approval.

Foire aux questions

Which assistants can use this skill?
The package declares support for Claude, Codex, and Claude Code. Specific tools and sibling skill integrations depend on the host environment.
Can I use it without an API key?
Local reference searches, design briefs, and HTML planning can work without provider credentials. AI logo, mockup, and icon generation requires configured credentials.
Which providers generate logos?
The logo script supports Gemini by default, with optional Atlas Cloud and MuAPI providers. Provider selection and credentials must be configured.
Can it use my existing logo?
The corporate identity generator accepts a local logo image for Gemini image editing. Approve uploading that image before generation.
Does it post directly to social platforms?
No. It guides asset design and screenshot export, not social posting or scheduling. Browser capture must be available for PNG exports.
What security precautions are needed?
Restrict authenticated requests to approved provider origins. Sanitize generated markup, keep browser sandboxing enabled, and review external requests before using sensitive assets.

Détails du développeur

Licence

MIT

Version de l’auteur

v2.1.0

Révision Skillstore

r1

Réf

698aebfbf8b189a05c80c44eca0361bb7899b093

Récence de maintenance

26/10/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📁 data/

📁 cip/

📄 deliverables.csv

📄 industries.csv

📄 mockup-contexts.csv

📄 styles.csv

📁 icon/

📄 styles.csv

📁 logo/

📄 colors.csv

📄 industries.csv

📄 styles.csv

📁 references/

📄 banner-sizes-and-styles.md

📄 cip-deliverable-guide.md

📄 cip-design.md

📄 cip-prompt-engineering.md

📄 cip-style-guide.md

📄 design-routing.md

📄 icon-design.md

📄 logo-color-psychology.md

📄 logo-design.md

📄 logo-prompt-engineering.md

📄 logo-style-guide.md

📄 slides-copywriting-formulas.md

📄 slides-create.md

📄 slides-html-template.md

📄 slides-layout-patterns.md

📄 slides-strategies.md

📄 slides.md

📄 social-photos-design.md

📁 scripts/

📁 cip/

📄 core.py

📄 generate.py

📄 render-html.py

📄 search.py

📁 icon/

📄 generate.py

📁 logo/

📄 core.py

📄 generate.py

📄 search.py

📁 tests/

📄 test_generate.py

📁 tests/

📄 test_cip_generate.py

📄 test_icon_generate.py

📄 SKILL.md

Autres compétences de nextlevelbuilder

Tout afficher
Tout afficher