📦

page

Name: page
Author: cmj-hub

콘텐츠 리비전 r1 중간 위험 🌐 네트워크 접근⚙️ 외부 명령어📁 파일 시스템 접근🔑 환경 변수⚡ 스크립트 포함

Draft and Check a Single Landing Page Brief

Landing page drafts can lose focus when they mix offers, actions, and site inventories. This skill structures one page brief and checks its required fields locally.

지원: Claude Codex Code(CC)

⚠️ 50 나쁨

Maintain this Skill? Claim it ⚠️ 50 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "page" from https://skillstore.io/skills/cmj-hub-page.md and its manifest at https://skillstore.io/api/skills/cmj-hub-page/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/cmj-hub-page.md 서명된 manifest GET /api/skills/cmj-hub-page/manifest 서명된 lockfile GET /api/skills/cmj-hub-page/lockfile

테스트해 보기

"page" 사용 중입니다. Check a brief for https://example.com/desk offering a weekly desk review and asking readers to reply.

예상 결과:

Accepted draft. Exit code: 0.
URL: https://example.com/desk
Offer: A weekly desk review that identifies one priority.
Action: Reply with the priority you want reviewed.

"page" 사용 중입니다. Check a draft containing a sitemap marker and a list of page addresses.

예상 결과:

Rejected draft: a sitemap.
Exit code: 1.
Revision guidance: choose one page address and define its offer and action.

"page" 사용 중입니다. Check a page draft with a URL and offer but no action.

예상 결과:

Rejected draft: draft is incomplete.
Exit code: 1.
Revision guidance: add a nonempty action string.

보안 감사

중간 위험

v1 • 2026. 10. 3. 버전별 보고서 열기

Most static detections are false positives involving JavaScript templates, CSS, documentation, and local validation. Asset generators contain HTML injection vulnerabilities, external font requests, and destructive cleanup of a caller-selected frames directory. No evidence found of credential theft, malicious exfiltration, or prompt injection; the Python scorer performs local input validation.

스캔된 파일

702

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

중간

assets/demo.mjs:67-68

Specification Data Can Escape the Inline Script

The demo embeds JSON.stringify output directly inside a script element. A specification string containing </script> can terminate that element and inject active HTML.

JSON.stringify does not escape HTML closing tags, and the serialized specification enters the script unchanged. This is separate from the detected innerHTML assignments.

중간

assets/card.mjs:17 assets/card.mjs:36-39 assets/demo.mjs:12 assets/demo.mjs:25-26

Unvalidated Color Values Can Inject Browser Markup

Both renderers insert accent_color directly into style elements without validation. A crafted color containing </style> can inject scripts or external resource loads.

The color comes directly from parsed specification data and bypasses text escaping. The generated markup is opened in a browser during asset rendering.

기능 검토 항목 (7)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response strings from the input specification are concatenated into h without escaping. Assigning h to innerHTML permits active markup from an untrusted specification.

중간

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines from the specification enter innerHTML without escaping. Crafted content can inject event handlers or unwanted network requests during rendering.

중간

assets/demo.mjs:4

Synchronous file operations

import { readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

rmSync recursively removes outGif + '.frames' before creating frames and again afterward. A selected output path can cause deletion of preexisting directory contents.

낮음

assets/card.mjs:22

Hardcoded URL

The generated page preconnects to Google Fonts during rendering, exposing connection metadata to a third party. This is a low privacy risk.

낮음

assets/card.mjs:23

Hardcoded URL

The generated page preconnects to Google's font asset host, exposing connection metadata during rendering. No credential transmission is present.

낮음

assets/card.mjs:24

Hardcoded URL

The stylesheet link fetches third-party font resources during rendering and exposes request metadata. The renderer has no offline switch.

낮음

assets/demo.mjs:16

Hardcoded URL

The demo page fetches Google Fonts while rendering, exposing request metadata to a third party. This creates a low privacy and external-dependency risk.

위험 요인

🌐 네트워크 접근 (12)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 assets/spec.json:10 CONTRIBUTING.md:32 examples/page-good.json:2 examples/page-sitemap.json:4 examples/page-sitemap.json:5 SKILL.md:56 tests/test_score.py:26

⚙️ 외부 명령어 (19)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:23 SKILL.md:33 SKILL.md:41-44 SKILL.md:44-48 SKILL.md:48 SKILL.md:54-60 tests/test_score.py:14

📁 파일 시스템 접근 (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 환경 변수 (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ 스크립트 포함 (2)

assets/demo.mjs:90 assets/demo.mjs:91

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/cmj-hub-page/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-page/security.svg)](https://skillstore.io/skills/cmj-hub-page?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/cmj-hub-page?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-page/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/cmj-hub-page.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

cmj-hub. (2026). page security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-page/audits/1

BibTeX 인용

@techreport{cmj-hub-cmj-hub-page-2026,
  author = {cmj-hub},
  title = {page security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-page/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "page security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-page/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-page:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Focus a Campaign Brief

Prepare a single destination, offer sentence, and next action before writing campaign page copy.

Define a Product Launch Page

Turn a product launch idea into a compact page brief without expanding it into a website inventory.

Check Drafts in a Local Workflow

Use the scorer's exit codes to check required draft fields and reject sitemap-shaped submissions.

이 프롬프트를 사용해 보세요

Create a First Page Brief

Draft one landing page brief for [product] at [URL]. Give one offer sentence and one clear action.

Improve an Existing Brief

Review this page brief: [brief]. Keep one URL, clarify the offer, and replace competing actions with one next step.

Validate a Saved Draft

Check [draft file] with the local page scorer. Explain any failure and propose edits without changing the intended offer or publishing anything.

Verify Rejection Rules

Compare [valid draft] with [sitemap draft] using the local scorer. Report exit codes and explain validation boundaries, including URL-prefix and copy-quality limitations.

모범 사례

Keep one destination and one next step, then review the offer manually for clarity.
Run the local scorer after revisions and review its exit code and message.
Use trusted inputs and dedicated output locations for asset tools only after addressing the documented rendering and cleanup risks.

피하기

Submitting a sitemap or URL list instead of a single page brief.
Treating a passing score as proof of good copy, a working URL, or a published page.
Rendering untrusted specifications or selecting output paths whose frames directories contain valuable files.

자주 묻는 질문

Which assistants can use this skill?

The marketplace lists Claude, Codex, and Claude Code. Local scoring requires access to Python 3 and the repository script.

Does the skill build or publish a landing page?

No. It guides page brief drafting and checks a local draft. Page implementation and publication remain separate tasks.

What does a passing score mean?

The draft has an HTTP or HTTPS prefix, nonempty offer and action strings, and no recognized sitemap markers.

Why does a sitemap fail?

The skill focuses on one page. The scorer rejects a sitemap kind, a urls list, or a URL containing sitemap.

Can scoring work offline?

Yes. The Python scorer uses the standard library and makes no network requests. Optional asset rendering requests Google Fonts.

Are the optional asset tools safe for untrusted input?

No. They contain HTML injection risks, and demo cleanup can delete a preexisting frames directory. Address these issues before rendering untrusted specifications.

개발자 세부 정보

작성자

cmj-hub

라이선스

MIT

Skillstore 리비전

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/cmj-hub/claude-landing-page/tree/0ba286f0c958b34c5075e6f9e6cb843b7512b9a9/

참조

e6935b8584b42b0bde0fa308df57389a91b36700

유지보수 최신성

2026. 10. 3.

사용량

0 다운로드 · 0 조회

파일 구조

📁 .claude-plugin/

📄 plugin.json

📄 .gitignore

📁 assets/

📄 card.mjs

📄 demo.gif

📄 demo.mjs

📄 header.png

📄 lockup.png

📄 social-lockup.png

📄 social-preview.png

📄 spec.json

📄 CONTRIBUTING.md

📁 examples/

📄 page-good.json

📄 page-sitemap.json

📄 LICENSE

📄 README.md

📁 scripts/

📄 score.py

📄 SKILL.md

📁 tests/

📄 test_score.py

cmj-hub의 다른 스킬

전체 보기

📦

pricing-reference-frames

Build Credible Pricing Anchors

Pricing copy can emphasize competitor discounts instead of the buyer's actual costs. This skill selects a credible reference frame and drafts quantified copy with bounded guarantees.

글쓰기 및 콘텐츠 보기

📦

indexability

Record a Single-URL Indexability Check

A page needs fetchability and listing evidence before its citation potential can be assessed. This skill organizes a single-URL checklist covering status, robots, sitemap, and scoring validation.

DevOps 및 인프라 보기

📦

cold-email-craft

Craft Signal-Anchored Cold Emails

Generic outreach is easy to ignore and difficult to validate. This skill turns a recent public signal into concise, specific outreach with a binary call to action.

커뮤니케이션 보기

📦

psp-construct

Build Evidence-Based Pain Signal Profiles

Broad customer segments and generic messaging make operational pain difficult to identify. This skill guides structured research linking recent signals, pain, timing, roles, and recipient vocabulary.

연구 및 학습 보기

📦

pricing-value-metric

Choose a Value Metric That Scales

Many B2B companies charge by a unit that does not track customer success, creating margin leakage, gaming, or expansion limits. This skill compares pricing units against four criteria and recommends a defensible hold or metric shift.

생산성 보기

📦

founder-content

Write Stronger Founder LinkedIn Posts

Founders often have useful experience but struggle to turn it into specific, credible LinkedIn posts. This skill structures one post around a clear pillar, hook, receipt, and founder voice.

글쓰기 및 콘텐츠 보기

전체 보기

📦

content-creator

브랜드 보이스로 SEO 콘텐츠 만들기

작성자 alirezarezvani

마케팅 팀에는 각 채널에 맞고 검색 목표를 지원하는 일관된 콘텐츠가 필요합니다. 이 스킬은 브랜드 보이스 가이드, 콘텐츠 템플릿, SEO 점검, 소셜 미디어 계획을 결합합니다.

글쓰기 및 콘텐츠 보기

📦

viral-short-form

높은 유지율의 숏폼 영상 만들기

작성자 vyralcontent

크리에이터는 후크가 모호하고 스크립트에 명확한 보상이 없어서 시청자를 잃는 경우가 많습니다. 이 스킬은 Claude, Codex, Claude Code에 후크, 스크립트, 캐러셀, 비평을 위한 구조화된 패턴을 제공합니다.

글쓰기 및 콘텐츠 보기

📦

viral-hooks

더 나은 숏폼 비디오 훅 만들기

작성자 vyralcontent

숏폼 비디오는 첫 몇 초가 관심을 끌지 못해 실패하는 경우가 많습니다. 이 스킬은 Claude, Codex, Claude Code가 시각, 언어, 텍스트 레이어를 활용해 훅을 생성하고, 비평하고, 다듬는 데 도움을 줍니다.

글쓰기 및 콘텐츠 보기

📦

xiaohongshu-copywriter

Xiaohongshu 마케팅 게시물 만들기

작성자 zhangchenlai-dev

제품 세부 정보, 판매 포인트, 태그를 하나의 캠페인에 맞춰야 할 때 Xiaohongshu 게시물 작성에는 시간이 걸립니다. 이 스킬은 이러한 입력을 제목, 해시태그, 커버 아이디어가 포함된 완성형 노트 초안으로 변환합니다.

글쓰기 및 콘텐츠 보기

📦

python-web-app-security-audit

Audit Python Web Apps Before Release

작성자 glenskii

Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.

보안 및 컴플라이언스 보기

📦

python-async-patterns

안정적인 비동기 Python 구축

작성자 0xDarkMatter

비동기 Python 코드는 블로킹 호출, 제한 없는 태스크, 취약한 정리 처리로 인해 자주 실패합니다. 이 스킬은 견고한 동시성 서비스를 위한 재사용 가능한 asyncio 패턴, 예제, 참조 자료를 제공합니다.

코딩 및 개발 보기

page

내 에이전트로 설치

에이전트가 읽기 쉬운 리소스

테스트해 보기

보안 감사

확인된 보안 우려 사항 (2)

위험 요인

보고서 링크 복사

Markdown 배지

HTML 배지

임베드 카드

APA 인용

BibTeX 인용

CITATION.cff

Skillstore 점수

만들 수 있는 것

Focus a Campaign Brief

Define a Product Launch Page

Check Drafts in a Local Workflow

이 프롬프트를 사용해 보세요

모범 사례

피하기

자주 묻는 질문

개발자 세부 정보

cmj-hub의 다른 스킬

pricing-reference-frames

indexability

cold-email-craft

psp-construct

pricing-value-metric

founder-content

관련 스킬

content-creator

viral-short-form

viral-hooks

xiaohongshu-copywriter

python-web-app-security-audit

python-async-patterns