📦

design

Name: design
Author: nextlevelbuilder

v2.1.0 콘텐츠 리비전 r1 중간 위험 🔑 환경 변수📁 파일 시스템 접근🌐 네트워크 접근⚙️ 외부 명령어

Create Logos, Icons, Mockups, and Presentations

Creating consistent visual assets across formats requires repeated research and setup. This skill combines searchable design references, asset generators, and HTML workflows.

지원: Claude Codex Code(CC)

⚠️ 50 나쁨

Maintain this Skill? Claim it ⚠️ 50 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "design" from https://skillstore.io/skills/nextlevelbuilder-design.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-design/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/nextlevelbuilder-design.md 서명된 manifest GET /api/skills/nextlevelbuilder-design/manifest 서명된 lockfile GET /api/skills/nextlevelbuilder-design/lockfile

테스트해 보기

"design" 사용 중입니다. Recommend a logo direction for a technology consultancy without using an API.

예상 결과:

Direction: a minimalist geometric mark with a restrained blue and teal palette.
Typography: a clear sans-serif with strong readability at small sizes.
Next review: compare the mark in monochrome and on a business card.

"design" 사용 중입니다. Prepare a business card mockup presentation using an approved logo.

예상 결과:

Mockup concept: a white business card with the supplied logo and restrained brand accents.
Presentation structure: brand overview, mockup image, intended use, and material guidance.
Review notes: verify logo accuracy, contact text, image format, and presentation rendering.

"design" 사용 중입니다. Plan a coordinated Instagram post and story for a product announcement.

예상 결과:

Post layout: 1080 by 1080 pixels with the product image, announcement headline, and one call to action.
Story layout: 1080 by 1920 pixels with important text inside the central safe area.
Export status: deliver HTML first when browser capture is unavailable; PNG export remains pending.

보안 감사

중간 위험

v1 • 2026. 10. 26. 버전별 보고서 열기

Most static findings are benign documentation, design terminology, mocked tests, or expected credential configuration. Confirmed findings expose API keys through unrestricted polling destinations and cross-origin redirects. Semantic findings identify incomplete DNS checks, unsanitized SVG and HTML output, and disabled browser sandboxing; no evidence found of deliberate prompt injection.

스캔된 파일

6,617

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (4)

중간

scripts/logo/generate.py:181-203 scripts/logo/generate.py:255-264

DNS Resolution Bypasses Private Address Checks

URL validation rejects literal private IP addresses but accepts unresolved hostnames. A provider-controlled hostname resolving internally can bypass the intended network boundary.

Nonliteral hostnames return before any DNS address check. Exploitation requires a suitable HTTPS endpoint and a malicious or compromised provider response.

중간

scripts/icon/generate.py:128-163 scripts/icon/generate.py:297-321

Generated SVG Is Saved Without Active Content Filtering

SVG extraction checks text structure but preserves scripts, event handlers, and external references. Malicious generated markup can execute when opened directly or embedded inline.

The extraction and save path contains no SVG element or attribute allowlist. Prompt instructions against external references do not enforce output safety.

중간

scripts/cip/render-html.py:109-119 scripts/cip/render-html.py:143-149 scripts/cip/render-html.py:342-364

Presentation Labels Are Interpolated Without HTML Escaping

Brand names and filename-derived labels enter HTML text and attributes without escaping. Crafted input can inject markup or scripts when the presentation is opened.

Python f-strings insert input directly into the title, image attributes, and headings. Exploitation requires crafted labels and opening the generated document.

중간

references/social-photos-design.md:126-140

Screenshot Workflow Disables Browser Sandboxing

The recommended Chrome command includes --no-sandbox while rendering HTML that may load external resources. This removes browser containment during screenshot export.

The documented command explicitly disables the Chrome sandbox without an isolation requirement. This increases compromise impact if rendered content exploits a browser vulnerability.

기능 검토 항목 (7)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

scripts/logo/generate.py:176

HTTP client library

def redirect_request(self, req, fp, code, msg, headers, newurl):

The redirect handler accepts unrelated HTTPS origins without removing authentication headers. A provider redirect can therefore disclose the API key to another host.

높음

scripts/logo/generate.py:178

HTTP client library

return super().redirect_request(req, fp, code, msg, headers, newurl)

The superclass redirect implementation copies authentication headers across origins. An offline standard-library check confirmed that x-api-key survives an HTTPS cross-host redirect.

높음

scripts/logo/generate.py:206

HTTP client library

def _json_request(

The request helper attaches credentials without restricting the destination origin. Its MuAPI caller supplies a response-controlled polling URL, enabling credential disclosure.

높음

scripts/logo/generate.py:444

HTTP client library

data = _json_request(

Polling sends x-api-key to result_url from the provider response. HTTPS validation does not restrict that URL to the MuAPI origin.

높음

scripts/logo/generate.py:222

Generic API/secret keys

api_key_header: auth_value,

This header attaches the API key to a URL without checking its provider origin. Response-controlled polling URLs can receive that credential.

높음

scripts/logo/generate.py:446

Generic API/secret keys

api_key,

The MuAPI key is passed to polling requests for a response-controlled URL. No same-origin check prevents sending the key to another HTTPS host.

높음

scripts/logo/generate.py:447

Generic API/secret keys

api_key_header="x-api-key",

The x-api-key header is explicitly enabled for the response-controlled polling URL. Arbitrary HTTPS destinations pass validation and can receive the credential.

위험 요인

🔑 환경 변수 (50)

📁 파일 시스템 접근 (25)

references/design-routing.md:167 references/design-routing.md:168 references/design-routing.md:173 references/design-routing.md:174 references/slides-copywriting-formulas.md:69 references/slides-copywriting-formulas.md:72 references/slides-html-template.md:161 references/slides-layout-patterns.md:116 references/slides-layout-patterns.md:119 references/slides-strategies.md:79 references/slides-strategies.md:82 scripts/cip/generate.py:285 scripts/cip/render-html.py:385 scripts/icon/generate.py:320 scripts/icon/generate.py:394 scripts/icon/generate.py:340 scripts/icon/generate.py:419 scripts/logo/generate.py:276 scripts/logo/generate.py:520 scripts/logo/generate.py:628 scripts/logo/tests/test_generate.py:5 scripts/logo/tests/test_generate.py:136 scripts/logo/tests/test_generate.py:329 scripts/logo/tests/test_generate.py:407 SKILL.md:42

🌐 네트워크 접근 (33)

⚙️ 외부 명령어 (50)

references/social-photos-design.md:170-181 references/social-photos-design.md:196-207 references/social-photos-design.md:138 scripts/icon/generate.py:110 scripts/icon/generate.py:124 scripts/icon/generate.py:132-133 scripts/icon/generate.py:133 scripts/icon/generate.py:138-140 scripts/icon/generate.py:140 scripts/logo/generate.py:5 scripts/logo/generate.py:6 scripts/logo/generate.py:18 scripts/tests/test_cip_generate.py:34 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:33 SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:42 SKILL.md:51-53 SKILL.md:53-57 SKILL.md:57-61 SKILL.md:61-67 SKILL.md:67-73 SKILL.md:73-77 SKILL.md:77 SKILL.md:85-87 SKILL.md:87-91 SKILL.md:91-96 SKILL.md:96-100 SKILL.md:100-112 SKILL.md:112-114 SKILL.md:114 SKILL.md:118-120 SKILL.md:120-128 SKILL.md:128-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-137 SKILL.md:137-138 SKILL.md:138-142 SKILL.md:142 SKILL.md:144-148 SKILL.md:148-149 SKILL.md:149 SKILL.md:193-197

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/nextlevelbuilder-design/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/nextlevelbuilder-design/security.svg)](https://skillstore.io/skills/nextlevelbuilder-design?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/nextlevelbuilder-design?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-design/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-design.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

nextlevelbuilder. (2026). design security audit report (audit version 1) [Author version 2.1.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-design/audits/1

BibTeX 인용

@techreport{nextlevelbuilder-nextlevelbuilder-design-2026,
  author = {nextlevelbuilder},
  title = {design security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/nextlevelbuilder-design/audits/1},
  note = {Author version 2.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "design security audit report (audit version 1)"
version: "2.1.0"
type: report
authors:
  - name: "nextlevelbuilder"
date-released: "2026-10-26"
url: "https://skillstore.io/skills/nextlevelbuilder-design/audits/1"
identifiers:
  - type: other
    value: "skillstore:nextlevelbuilder-design:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Explore a Startup Identity

Compare logo directions and create business card or signage mockups before committing to a brand identity.

Prepare a Multi-Platform Campaign

Develop coordinated banner and social image concepts at platform-specific dimensions, then export approved layouts when browser capture is available.

Prototype Interface Icons

Generate SVG icon variations with consistent styling, colors, and display sizes for review before application integration.

이 프롬프트를 사용해 보세요

Find a Logo Direction

Search local logo references for [brand] in [industry]. Recommend three styles and a palette with reasons. Do not call external APIs.

Generate Logo Concepts

Create three white-background logo concepts for [brand] using [provider] and [style]. Confirm API usage and costs first. Save approved outputs in [directory].

Build an Identity Presentation

Use [logo image] to create business card, letterhead, and signage mockups for [brand]. Confirm external uploads first. Build an HTML presentation from PNG outputs.

Coordinate a Campaign Asset Set

Plan coordinated LinkedIn, Instagram post, and story assets for [campaign]. Apply [brand guidelines] and [approved assets]. Check sibling skills and browser availability before proceeding. Present concepts before rendering. Review generated HTML and SVG before previewing. Report export dimensions and pending work.

모범 사례

Provide approved brand guidelines, target platforms, exact dimensions, and a dedicated output directory before generation.
Approve provider requests and logo uploads explicitly; use dedicated API credentials and avoid confidential material.
Review generated HTML and SVG before opening; verify image dimensions, text accuracy, contrast, and safe zones before delivery.

피하기

Treating generated logos or mockups as final trademark clearance or print-ready production artwork.
Assuming sibling skills, provider credentials, or screenshot tools are installed without checking.
Opening unreviewed generated markup or sending confidential brand assets to external providers without approval.

자주 묻는 질문

Which assistants can use this skill?

The package declares support for Claude, Codex, and Claude Code. Specific tools and sibling skill integrations depend on the host environment.

Can I use it without an API key?

Local reference searches, design briefs, and HTML planning can work without provider credentials. AI logo, mockup, and icon generation requires configured credentials.

Which providers generate logos?

The logo script supports Gemini by default, with optional Atlas Cloud and MuAPI providers. Provider selection and credentials must be configured.

Can it use my existing logo?

The corporate identity generator accepts a local logo image for Gemini image editing. Approve uploading that image before generation.

Does it post directly to social platforms?

No. It guides asset design and screenshot export, not social posting or scheduling. Browser capture must be available for PNG exports.

What security precautions are needed?

Restrict authenticated requests to approved provider origins. Sanitize generated markup, keep browser sandboxing enabled, and review external requests before using sensitive assets.