📦

page

Name: page
Author: cmj-hub

Ревизия содержимого r1 Средний риск 🌐 Доступ к сети⚙️ Внешние команды📁 Доступ к файловой системе🔑 Переменные окружения⚡ Содержит скрипты

Draft and Check a Single Landing Page Brief

Landing page drafts can lose focus when they mix offers, actions, and site inventories. This skill structures one page brief and checks its required fields locally.

Поддерживает: Claude Codex Code(CC)

⚠️ 50 Плохо

Maintain this Skill? Claim it ⚠️ 50 Плохо

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "page" from https://skillstore.io/skills/cmj-hub-page.md and its manifest at https://skillstore.io/api/skills/cmj-hub-page/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/cmj-hub-page.md Подписанный manifest GET /api/skills/cmj-hub-page/manifest Подписанный lockfile GET /api/skills/cmj-hub-page/lockfile

Протестировать

Использование «page». Check a brief for https://example.com/desk offering a weekly desk review and asking readers to reply.

Ожидаемый результат:

Accepted draft. Exit code: 0.
URL: https://example.com/desk
Offer: A weekly desk review that identifies one priority.
Action: Reply with the priority you want reviewed.

Использование «page». Check a draft containing a sitemap marker and a list of page addresses.

Ожидаемый результат:

Rejected draft: a sitemap.
Exit code: 1.
Revision guidance: choose one page address and define its offer and action.

Использование «page». Check a page draft with a URL and offer but no action.

Ожидаемый результат:

Rejected draft: draft is incomplete.
Exit code: 1.
Revision guidance: add a nonempty action string.

Аудит безопасности

Средний риск

v1 • 03.10.2026 Открыть версионный отчет

Most static detections are false positives involving JavaScript templates, CSS, documentation, and local validation. Asset generators contain HTML injection vulnerabilities, external font requests, and destructive cleanup of a caller-selected frames directory. No evidence found of credential theft, malicious exfiltration, or prompt injection; the Python scorer performs local input validation.

Просканировано файлов

702

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Средний

assets/demo.mjs:67-68

Specification Data Can Escape the Inline Script

The demo embeds JSON.stringify output directly inside a script element. A specification string containing </script> can terminate that element and inject active HTML.

JSON.stringify does not escape HTML closing tags, and the serialized specification enters the script unchanged. This is separate from the detected innerHTML assignments.

Средний

assets/card.mjs:17 assets/card.mjs:36-39 assets/demo.mjs:12 assets/demo.mjs:25-26

Unvalidated Color Values Can Inject Browser Markup

Both renderers insert accent_color directly into style elements without validation. A crafted color containing </style> can inject scripts or external resource loads.

The color comes directly from parsed specification data and bypasses text escaping. The generated markup is opened in a browser during asset rendering.

Пункты проверки возможностей (7)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

assets/demo.mjs:90

innerHTML assignment (XSS risk)

document.getElementById('lines').innerHTML = h;

Response strings from the input specification are concatenated into h without escaping. Assigning h to innerHTML permits active markup from an untrusted specification.

Средний

assets/demo.mjs:91

innerHTML assignment (XSS risk)

document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)

Artifact labels and lines from the specification enter innerHTML without escaping. Crafted content can inject event handlers or unwanted network requests during rendering.

Средний

assets/demo.mjs:4

Synchronous file operations

import { readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

rmSync recursively removes outGif + '.frames' before creating frames and again afterward. A selected output path can cause deletion of preexisting directory contents.

Низкий

assets/card.mjs:22

Hardcoded URL

The generated page preconnects to Google Fonts during rendering, exposing connection metadata to a third party. This is a low privacy risk.

Низкий

assets/card.mjs:23

Hardcoded URL

The generated page preconnects to Google's font asset host, exposing connection metadata during rendering. No credential transmission is present.

Низкий

assets/card.mjs:24

Hardcoded URL

The stylesheet link fetches third-party font resources during rendering and exposes request metadata. The renderer has no offline switch.

Низкий

assets/demo.mjs:16

Hardcoded URL

The demo page fetches Google Fonts while rendering, exposing request metadata to a third party. This creates a low privacy and external-dependency risk.

Факторы риска

🌐 Доступ к сети (12)

.claude-plugin/plugin.json:9 assets/card.mjs:22 assets/card.mjs:23 assets/card.mjs:24 assets/demo.mjs:16 assets/spec.json:10 CONTRIBUTING.md:32 examples/page-good.json:2 examples/page-sitemap.json:4 examples/page-sitemap.json:5 SKILL.md:56 tests/test_score.py:26

⚙️ Внешние команды (19)

assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:23 SKILL.md:33 SKILL.md:41-44 SKILL.md:44-48 SKILL.md:48 SKILL.md:54-60 tests/test_score.py:14

📁 Доступ к файловой системе (7)

assets/card.mjs:3 assets/card.mjs:92 assets/card.mjs:96 assets/demo.mjs:4 assets/demo.mjs:100 assets/demo.mjs:103 assets/demo.mjs:39

🔑 Переменные окружения (2)

assets/card.mjs:7 assets/card.mjs:7

⚡ Содержит скрипты (2)

assets/demo.mjs:90 assets/demo.mjs:91

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/cmj-hub-page/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/cmj-hub-page/security.svg)](https://skillstore.io/skills/cmj-hub-page?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/cmj-hub-page?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-page/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/cmj-hub-page.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

cmj-hub. (2026). page security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-page/audits/1

Цитата BibTeX

@techreport{cmj-hub-cmj-hub-page-2026,
  author = {cmj-hub},
  title = {page security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/cmj-hub-page/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "page security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-page/audits/1"
identifiers:
  - type: other
    value: "skillstore:cmj-hub-page:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Focus a Campaign Brief

Prepare a single destination, offer sentence, and next action before writing campaign page copy.

Define a Product Launch Page

Turn a product launch idea into a compact page brief without expanding it into a website inventory.

Check Drafts in a Local Workflow

Use the scorer's exit codes to check required draft fields and reject sitemap-shaped submissions.

Попробуйте эти промпты

Create a First Page Brief

Draft one landing page brief for [product] at [URL]. Give one offer sentence and one clear action.

Improve an Existing Brief

Review this page brief: [brief]. Keep one URL, clarify the offer, and replace competing actions with one next step.

Validate a Saved Draft

Check [draft file] with the local page scorer. Explain any failure and propose edits without changing the intended offer or publishing anything.

Verify Rejection Rules

Compare [valid draft] with [sitemap draft] using the local scorer. Report exit codes and explain validation boundaries, including URL-prefix and copy-quality limitations.

Лучшие практики

Keep one destination and one next step, then review the offer manually for clarity.
Run the local scorer after revisions and review its exit code and message.
Use trusted inputs and dedicated output locations for asset tools only after addressing the documented rendering and cleanup risks.

Избегать

Submitting a sitemap or URL list instead of a single page brief.
Treating a passing score as proof of good copy, a working URL, or a published page.
Rendering untrusted specifications or selecting output paths whose frames directories contain valuable files.

Часто задаваемые вопросы

Which assistants can use this skill?

The marketplace lists Claude, Codex, and Claude Code. Local scoring requires access to Python 3 and the repository script.

Does the skill build or publish a landing page?

No. It guides page brief drafting and checks a local draft. Page implementation and publication remain separate tasks.

What does a passing score mean?

The draft has an HTTP or HTTPS prefix, nonempty offer and action strings, and no recognized sitemap markers.

Why does a sitemap fail?

The skill focuses on one page. The scorer rejects a sitemap kind, a urls list, or a URL containing sitemap.

Can scoring work offline?

Yes. The Python scorer uses the standard library and makes no network requests. Optional asset rendering requests Google Fonts.

Are the optional asset tools safe for untrusted input?

No. They contain HTML injection risks, and demo cleanup can delete a preexisting frames directory. Address these issues before rendering untrusted specifications.