스킬 huashu-design

📦

huashu-design

Name: huashu-design
Author: alchaincyf

v2.0 콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근🔑 환경 변수📁 파일 시스템 접근⚙️ 외부 명령어⚡ 스크립트 포함

Create HTML Prototypes, Slides, and Animations

Visual briefs need clear direction, consistent assets, and practical export options. Huashu Design guides three visual drafts, HTML implementation, local verification, and optional presentation or video exports.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "huashu-design" from https://skillstore.io/skills/alchaincyf-huashu-design.md and its manifest at https://skillstore.io/api/skills/alchaincyf-huashu-design/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/alchaincyf-huashu-design.md 서명된 manifest GET /api/skills/alchaincyf-huashu-design/manifest 서명된 lockfile GET /api/skills/alchaincyf-huashu-design/lockfile

테스트해 보기

"huashu-design" 사용 중입니다. Create an onboarding prototype for a reading application using supplied screenshots.

예상 결과:

Three visual direction screenshots for selection.
An approved HTML prototype with interactive onboarding screens.
A verification summary covering key clicks and remaining limitations.

"huashu-design" 사용 중입니다. Turn an approved workshop outline into an eight-slide presentation.

예상 결과:

Representative slides in three distinct visual directions.
A selected HTML deck with overview navigation and a PDF handout.
An editable PPTX when requested, with export fidelity notes.

"huashu-design" 사용 중입니다. Produce a short product demonstration from approved interface images.

예상 결과:

Three direction boards followed by an approved storyboard.
An HTML animation and MP4 with planned music and sound effects.
A quality checklist covering framing, text, timing, and audio.

보안 감사

높은 위험

v1 • 2026. 10. 13. 버전별 보고서 열기

All 400 supplied findings were adjudicated; most match benign design text, dependency checksums, or declared local tooling. Retained risks concern Python execution, cloud consent and transport, proxy bypass, browser credentials, unescaped labels, destructive cleanup, and global installation. No evidence found of deliberate malware or auditor-targeted prompt injection; 1,337 omitted matches still require manual review before automatic publication. Static review was capped at 400/1737 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

125

스캔된 파일

52,622

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (4)

높음

scripts/sfx-cues.sh:24-29 scripts/verify-video.sh:56-65

Media Parameters Become Executable Python

Cue timestamps and verification options are interpolated into Python source without validation. Crafted cue files or parameter values can execute code with user privileges.

Source inspection directly shows unvalidated TSV text and command-line values inserted into Python expressions or quoted literals. No exploit execution was required or performed.

중간

scripts/narrate-pipeline.mjs:203-207 scripts/narrate-pipeline.mjs:347-348 SECURITY.md:36

Cleanup Can Delete Existing User Files

The narration pipeline reuses an existing .tmp directory beneath the requested output directory, then recursively deletes it. Existing unrelated files can be lost.

Recursive creation accepts existing directories, and cleanup deletes the whole directory without ownership checks. This contradicts the claimed unique, script-owned scratch guarantee.

중간

scripts/cloud/ai-review-video.py:269-286 scripts/cloud/ai-review-video.py:199-205 scripts/cloud/ai-review-video.py:152-160 SECURITY.md:11

Cloud Consent Omits Director-Note Uploads

The consent message describes compressed video uploads, but optional director notes also enter remote prompts. Confidential planning text can leave without specific disclosure.

The context file is read into prompts submitted through session.post. The consent notice and destination table describe video, but do not enumerate director-note text.

중간

SKILL.md:392 references/hyperframes-backend.md:22-34

Default Workflow Trusts an Unpinned Initializer

The recommended npx initializer uses automatic acceptance without a version pin. Third-party executable code can change before project-level pinning and install additional agent instructions.

The command uses npx -y without a version; only the generated project receives a version pin. Upstream package behavior was not executed or verified.

기능 검토 항목 (20)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

scripts/verify-video.sh:48

Dynamic code evaluation with eval()

FPS=$(python3 -c "print(round(eval('${FPS_RAW:-0}' if '${FPS_RAW:-0}'!='0/0' else '0'),2))" 2>/dev/n

Python eval parses ffprobe output as executable source, but normal frame-rate output is a numeric fraction. No direct attacker-controlled path was established; retained conservatively.

높음

references/hyperframes-backend.md:23

Hidden file in home directory

> `~/.claude/skills/`**(渲染后端的合成契约文档,纯文档无可执行 hook)。介意的话先跑

The documented initializer installs 19 instruction skills into the global agent directory. These changes expand persistent instruction trust beyond the current project.

높음

references/hyperframes-backend.md:31

Hidden file in home directory

生成 index.html / hyperframes.json / meta.json / package.json(pin 了 CLI 版本)+ 项目级 CLAUDE.md。init 会把 19

The documented initializer installs 19 instruction skills into the global agent directory. These changes expand persistent instruction trust beyond the current project.

높음

scripts/cloud/tts-doubao.mjs:195

Environment variable access (dot notation)

const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v3/tts/uni

Only the initial hostname is checked; HTTPS and redirect destinations are not enforced. Custom authentication headers can leak through plaintext transport or unsafe redirects.

높음

scripts/cloud/tts-doubao.mjs:221

Fetch API call

const res = await fetch(endpoint, {

Only the initial hostname is checked; HTTPS and redirect destinations are not enforced. Custom authentication headers can leak through plaintext transport or unsafe redirects.

높음

scripts/cloud/tts-doubao.mjs:195

Hardcoded URL

const endpoint = process.env.DOUBAO_TTS_ENDPOINT || 'https://openspeech.bytedance.com/api/v3/tts/uni

Only the initial hostname is checked; HTTPS and redirect destinations are not enforced. Custom authentication headers can leak through plaintext transport or unsafe redirects.

중간

references/hyperframes-backend.md:23

Hidden file access

> `~/.claude/skills/`**(渲染后端的合成契约文档,纯文档无可执行 hook)。介意的话先跑

The initializer is documented to write additional skills into a global instruction directory. This creates persistent trust changes outside the project.

중간

references/hyperframes-backend.md:31

Hidden file access

生成 index.html / hyperframes.json / meta.json / package.json(pin 了 CLI 版本)+ 项目级 CLAUDE.md。init 会把 19

The initializer is documented to write additional skills into a global instruction directory. This creates persistent trust changes outside the project.

중간

assets/deck_index.html:307

innerHTML assignment (XSS risk)

counter.innerHTML = (idx + 1) + ' / ' + deck.length + ' <span class="label">' + (deck[idx].label ||

Labels enter innerHTML without escaping, allowing scriptable markup if untrusted titles are reused. The bundled manifest is inline and benign; external attacker control is unproven.

중간

scripts/cloud/tts-doubao.mjs:44

Node.js fs operations

const text = fs.readFileSync(envPath, 'utf8');

The loader imports arbitrary configuration keys into process.env before consent checks. A configuration file can set HUASHU_CLOUD_OK=1 and bypass invocation approval.

중간

references/ai-video-review.md:19

Proxy environment variable

cd 项目目录 && unset ALL_PROXY # 脚本内已免疫代理,unset是双保险

This code or instruction disables inherited proxy routing. Requests can bypass required enterprise inspection or privacy controls despite the stated TLS troubleshooting purpose.

중간

references/brand-asset-protocol.md:77

Proxy environment variable

unset ALL_PROXY HTTP_PROXY HTTPS_PROXY all_proxy http_proxy https_proxy # 清代理,否则 TLS 易炸

This code or instruction disables inherited proxy routing. Requests can bypass required enterprise inspection or privacy controls despite the stated TLS troubleshooting purpose.

중간

scripts/cloud/ai-review-video.py:31

Proxy environment variable

代理:requests session 关闭 trust_env(不继承本机代理配置),免疫 ALL_PROXY 之类残留代理导致的 TLS 报错。

This code or instruction disables inherited proxy routing. Requests can bypass required enterprise inspection or privacy controls despite the stated TLS troubleshooting purpose.

중간

scripts/cloud/ai-review-video.py:286

Proxy environment variable

session.trust_env = False # 免疫 ALL_PROXY 等代理坑

This code or instruction disables inherited proxy routing. Requests can bypass required enterprise inspection or privacy controls despite the stated TLS troubleshooting purpose.

중간

scripts/fetch_images.py:18

Proxy environment variable

for _k in ("ALL_PROXY", "all_proxy", "HTTP_PROXY", "http_proxy", "HTTPS_PROXY", "https_proxy"):

This code or instruction disables inherited proxy routing. Requests can bypass required enterprise inspection or privacy controls despite the stated TLS troubleshooting purpose.

중간

scripts/cloud/tts-doubao.mjs:44

Synchronous file operations

const text = fs.readFileSync(envPath, 'utf8');

The loader imports arbitrary configuration keys into process.env before consent checks. A configuration file can set HUASHU_CLOUD_OK=1 and bypass invocation approval.

중간

references/react-setup.md:154

Fetch API call

const res = await fetch('https://api.anthropic.com/v1/messages', {

The optional example exposes the entered API key to page scripts and the visible DOM. Local-demo warnings and recommended mocks reduce usage, not credential exposure.

낮음

scripts/cloud/tts-doubao.mjs:55

Environment variable access (bracket notation)

if (!(key in process.env)) process.env[key] = val;

The loader imports arbitrary configuration keys into process.env before consent checks. A configuration file can set HUASHU_CLOUD_OK=1 and bypass invocation approval.

낮음

scripts/cloud/tts-doubao.mjs:55

Environment variable object

if (!(key in process.env)) process.env[key] = val;

The loader imports arbitrary configuration keys into process.env before consent checks. A configuration file can set HUASHU_CLOUD_OK=1 and bypass invocation approval.

낮음

scripts/fetch_images.py:19

Python environment access

os.environ.pop(_k, None)

This code or instruction disables inherited proxy routing. Requests can bypass required enterprise inspection or privacy controls despite the stated TLS troubleshooting purpose.

위험 요인

🌐 네트워크 접근 (50)

🔑 환경 변수 (50)

📁 파일 시스템 접근 (50)

.gitignore:3 .gitignore:7 assets/narration_stage.jsx:352 assets/narration_stage.jsx:424 assets/narration_stage.jsx:440 assets/personal-asset-index.example.json:4 assets/personal-asset-index.example.json:4 demos/hero-animation-v10-en.html:970 demos/md-html-narration/md-html-demo.html:256 demos/w3-fallback-advisor-en.html:350 demos/w3-fallback-advisor-en.html:361 demos/w3-fallback-advisor-en.html:372 demos/w3-fallback-advisor.html:357 demos/w3-fallback-advisor.html:369 demos/w3-fallback-advisor.html:381 README.en.md:58 README.en.md:67 README.en.md:58 README.en.md:67 README.md:70 README.md:79 README.md:70 README.md:79 references/ai-video-review.md:20 references/ai-video-review.md:20 references/animation-pitfalls.md:365 references/brand-asset-protocol.md:79 references/camera-language.md:198 references/cinematic-patterns.md:179 references/editable-pptx.md:243 references/hero-animation-case-study.md:5 references/hyperframes-backend.md:23 references/hyperframes-backend.md:31 references/hyperframes-backend.md:42 references/hyperframes-backend.md:43 references/hyperframes-backend.md:23 references/hyperframes-backend.md:31 references/hyperframes-backend.md:42 references/hyperframes-backend.md:43 references/sfx-library.md:226 references/slide-decks.md:225 references/slide-decks.md:257 references/slide-decks.md:321 references/slide-decks.md:175 references/slide-decks.md:175 references/verification.md:58 references/verification.md:58 scripts/add-music.sh:7 scripts/add-music.sh:36 scripts/cloud/ai-review-video.py:40

⚙️ 외부 명령어 (50)

⚡ 스크립트 포함 (23)

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/alchaincyf-huashu-design/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/alchaincyf-huashu-design/security.svg)](https://skillstore.io/skills/alchaincyf-huashu-design?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/alchaincyf-huashu-design?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/alchaincyf-huashu-design/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/alchaincyf-huashu-design.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

alchaincyf. (2026). huashu-design security audit report (audit version 1) [Author version 2.0]. Skillstore. https://skillstore.io/skills/alchaincyf-huashu-design/audits/1

BibTeX 인용

@techreport{alchaincyf-alchaincyf-huashu-design-2026,
  author = {alchaincyf},
  title = {huashu-design security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/alchaincyf-huashu-design/audits/1},
  note = {Author version 2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "huashu-design security audit report (audit version 1)"
version: "2.0"
type: report
authors:
  - name: "alchaincyf"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/alchaincyf-huashu-design/audits/1"
identifiers:
  - type: other
    value: "skillstore:alchaincyf-huashu-design:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Compare Product Interface Directions

Explore three branded interface drafts, select a direction, and build an interactive prototype for stakeholder review.

Build Training Presentations

Turn approved teaching material into navigable HTML slides, a PDF handout, and an optional editable PowerPoint deck.

Produce Product Demonstration Videos

Plan keyframes, animate approved product assets, and export videos with narration, captions, music, and sound effects.

이 프롬프트를 사용해 보세요

Explore Three Design Directions

Create three HTML infographic drafts about [topic] for [audience]. Use [approved content]. Show screenshots and wait for my selection.

Build an Interactive Prototype

Prototype [product] using [brand assets] and [key flows]. Show three directions first. After approval, implement interactions and verify clicks locally.

Create a Presentation Package

Design a [slide count]-slide deck from [outline] for [audience]. Show three representative directions. After approval, deliver HTML and PDF. Ask before PPTX export.

Direct a Product Animation

Plan a [duration]-second animation using [approved assets]. Show three direction boards, then storyboard the selected direction. Export MP4 with captions and audio. Keep cloud tools disabled and request approval before external installation.

모범 사례

Provide approved content, brand assets, audience details, and output dimensions before selecting a direction.
Verify screenshots, interactions, typography, and exported files before delivery.
Fix reported issues before using bundled scripts in an isolated project. Require explicit approval for cloud transfers and global skill installation.

피하기

Use the skill as a substitute for production application engineering or backend architecture.
Run bundled scripts on untrusted cue tables or parameter values before fixing the reported injection risks.
Upload confidential notes or enter production API keys into browser demos without reviewing data exposure.

자주 묻는 질문

Which assistants can use this skill?

The report lists Claude, Codex, and Claude Code. Tool access and available runtime features determine which workflows can run.

Does every task require three design directions?

New visual designs normally start with three drafts. Explicit user waivers, approved-direction iterations, and mechanical export tasks are documented exceptions.

Can it export editable PowerPoint presentations?

Yes. Supplied scripts support constrained HTML conversion and rendered-layout conversion. Review editability and visual fidelity after export.

Do I need API keys?

Local design and export scripts do not require API keys. Optional cloud narration and video review require your credentials and approval.

Will every workflow run offline?

No. Asset searches, font downloads, package installation, update checks, and optional cloud tools can use the network.

What security precautions are required?

Fix reported script risks and use trusted inputs with isolated output directories. Review uploaded text, videos, and global skill installations before approval.