Навыки answer-me-with-html

📦

answer-me-with-html

Name: answer-me-with-html
Author: qingyuna

Ревизия содержимого r1 Высокий риск 📁 Доступ к файловой системе🔑 Переменные окружения⚡ Содержит скрипты⚙️ Внешние команды🌐 Доступ к сети

Turn Complex Answers Into Visual HTML Explainers

Complex explanations can hide relationships and trade-offs in long text. This skill turns Markdown drafts into visual HTML pages with diagrams, tables, and focused panels.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "answer-me-with-html" from https://skillstore.io/skills/qingyuna-answer-me-with-html.md and its manifest at https://skillstore.io/api/skills/qingyuna-answer-me-with-html/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/qingyuna-answer-me-with-html.md Подписанный manifest GET /api/skills/qingyuna-answer-me-with-html/manifest Подписанный lockfile GET /api/skills/qingyuna-answer-me-with-html/lockfile

Протестировать

Использование «answer-me-with-html». Explain how a cache handles requests.

Ожидаемый результат:

A local HTML page with a request-flow diagram showing cache hits and misses.
A comparison table explains latency, freshness, and failure behavior.
A conclusion panel states when cached data is returned.

Использование «answer-me-with-html». Explain the TCP handshake as a video with voice off.

Ожидаемый результат:

A local player page presents connection setup as captioned scenes.
A sequence diagram reveals SYN, SYN-ACK, and ACK in order.
The player includes scene navigation, playback speed, and export controls.

Аудит безопасности

Высокий риск

v1 • 29.10.2026 Открыть версионный отчет

Most supplied matches concern embedded assets, parser syntax, or secret-blocking checks; no evidence found of destructive intent or audit-targeted prompt injection. Speech transport, implicit cloud narration, and optional plaintext LAN sharing create credential and privacy risks. All 400 supplied findings are adjudicated; 1,812 unpresented matches still require manual review before automatic publication. Static review was capped at 400/2212 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Просканировано файлов

13,383

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Высокий

scripts/am.mjs:10612

Environment file access

const headers = { "content-type": "application/json", ...env.AM_TTS_API_KEY ? { authorization: `Bear

AM_TTS_API_KEY becomes a Bearer header for AM_TTS_URL. localSpeech does not require HTTPS or loopback, so remote HTTP exposes credentials and narration.

Средний

references/video.md:34 scripts/am.mjs:10545-10562

Cloud Narration Selected Without Provider-Specific Consent

Video narration defaults to auto and selects ElevenLabs whenever ELEVENLABS_API_KEY exists. A video request can therefore send private narration externally without a provider-specific choice.

The instructions require a video request but no cloud-provider confirmation. pickProvider chooses ElevenLabs from an ambient key before considering system speech.

Пункты проверки возможностей (4)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

scripts/am.mjs:10612

Generic API/secret keys

const headers = { "content-type": "application/json", ...env.AM_TTS_API_KEY ? { authorization: `Bear

The optional AM_TTS_API_KEY is sent to an unrestricted configured URL. Plaintext remote HTTP can disclose the token and narration.

Средний

scripts/am.mjs:11570

Hardcoded IP address

var LAN_BIND = "0.0.0.0";

The optional LAN mode binds 0.0.0.0 and serves capability URLs over HTTP. Network observers can capture links and read shared private pages.

Низкий

scripts/am.mjs:10618

Fetch API call

res = await fetch(url, {

localSpeech posts narration and optional Bearer credentials to AM_TTS_URL without transport restrictions. A remote HTTP endpoint exposes this data in transit.

Низкий

scripts/am.mjs:10649

HTTP client library

const samples = trimSilence(await request(text2));

request(text2) invokes localSpeech against the configured endpoint. Its URL lacks HTTPS or loopback enforcement, so narration can cross an unencrypted remote connection.

Факторы риска

📁 Доступ к файловой системе (50)

references/settings.md:19 references/settings.md:19 references/video.md:3 references/video.md:35 references/video.md:35 scripts/am.mjs:33 scripts/am.mjs:2065 scripts/am.mjs:2409 scripts/am.mjs:9155 scripts/am.mjs:9161 scripts/am.mjs:9341 scripts/am.mjs:9490 scripts/am.mjs:9847 scripts/am.mjs:9946 scripts/am.mjs:9973 scripts/am.mjs:9991 scripts/am.mjs:9995 scripts/am.mjs:10001 scripts/am.mjs:10011 scripts/am.mjs:10169 scripts/am.mjs:10183 scripts/am.mjs:10507 scripts/am.mjs:10682 scripts/am.mjs:10698 scripts/am.mjs:10765 scripts/am.mjs:10850 scripts/am.mjs:10861 scripts/am.mjs:11057 scripts/am.mjs:11157 scripts/am.mjs:11247 scripts/am.mjs:11565 scripts/am.mjs:11670 scripts/am.mjs:11682 scripts/am.mjs:11730 scripts/am.mjs:11756 scripts/am.mjs:11765 scripts/am.mjs:12279 scripts/am.mjs:12361 scripts/am.mjs:12477 scripts/am.mjs:12491 scripts/am.mjs:12635 scripts/am.mjs:12638 scripts/am.mjs:639 scripts/am.mjs:7327 scripts/am.mjs:7613 scripts/am.mjs:12048 scripts/am.mjs:12182 scripts/am.mjs:12415 scripts/am.mjs:12424 scripts/am.mjs:27

🔑 Переменные окружения (21)

⚡ Содержит скрипты (49)

scripts/am.mjs:639 scripts/am.mjs:10520 scripts/am.mjs:639 scripts/am.mjs:1355 scripts/am.mjs:27 scripts/am.mjs:27 scripts/am.mjs:27 scripts/am.mjs:1146 scripts/am.mjs:2694 scripts/am.mjs:2701 scripts/am.mjs:2717 scripts/am.mjs:2721 scripts/am.mjs:2728 scripts/am.mjs:2735 scripts/am.mjs:2747 scripts/am.mjs:2752 scripts/am.mjs:2797 scripts/am.mjs:2804 scripts/am.mjs:2845 scripts/am.mjs:2860 scripts/am.mjs:2867 scripts/am.mjs:2875 scripts/am.mjs:2888 scripts/am.mjs:2896 scripts/am.mjs:2904 scripts/am.mjs:2908 scripts/am.mjs:2912 scripts/am.mjs:2916 scripts/am.mjs:2935 scripts/am.mjs:2943 scripts/am.mjs:2955 scripts/am.mjs:2957 scripts/am.mjs:2959 scripts/am.mjs:2984 scripts/am.mjs:2991 scripts/am.mjs:2995 scripts/am.mjs:2997 scripts/am.mjs:2999 scripts/am.mjs:3013 scripts/am.mjs:3021 scripts/am.mjs:3027 scripts/am.mjs:3035 scripts/am.mjs:4007 scripts/am.mjs:4032 scripts/am.mjs:4034 scripts/am.mjs:4107 scripts/am.mjs:4112 scripts/am.mjs:4204 scripts/am.mjs:4206

⚙️ Внешние команды (50)

scripts/am.mjs:1361 scripts/am.mjs:10505 scripts/am.mjs:10512 scripts/am.mjs:11056 scripts/am.mjs:11323 scripts/am.mjs:11562 scripts/am.mjs:10754 scripts/am.mjs:27 scripts/am.mjs:1146 scripts/am.mjs:2694 scripts/am.mjs:2701 scripts/am.mjs:2717 scripts/am.mjs:2721 scripts/am.mjs:2728 scripts/am.mjs:2735 scripts/am.mjs:2747 scripts/am.mjs:2752 scripts/am.mjs:2797 scripts/am.mjs:2804 scripts/am.mjs:2845 scripts/am.mjs:2860 scripts/am.mjs:2867 scripts/am.mjs:2875 scripts/am.mjs:2888 scripts/am.mjs:2896 scripts/am.mjs:2904 scripts/am.mjs:2908 scripts/am.mjs:2912 scripts/am.mjs:2916 scripts/am.mjs:2935 scripts/am.mjs:2943 scripts/am.mjs:2955 scripts/am.mjs:2957 scripts/am.mjs:2959 scripts/am.mjs:2984 scripts/am.mjs:2991 scripts/am.mjs:2995 scripts/am.mjs:2997 scripts/am.mjs:2999 scripts/am.mjs:3013 scripts/am.mjs:3021 scripts/am.mjs:3027 scripts/am.mjs:3035 scripts/am.mjs:4007 scripts/am.mjs:4032 scripts/am.mjs:4034 scripts/am.mjs:4107 scripts/am.mjs:4112 scripts/am.mjs:4204 scripts/am.mjs:4206

🌐 Доступ к сети (37)

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/qingyuna-answer-me-with-html/security.svg)](https://skillstore.io/skills/qingyuna-answer-me-with-html?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/qingyuna-answer-me-with-html?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/qingyuna-answer-me-with-html/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/qingyuna-answer-me-with-html.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

qingyuna. (2026). answer-me-with-html security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1

Цитата BibTeX

@techreport{qingyuna-qingyuna-answer-me-with-html-2026,
  author = {qingyuna},
  title = {answer-me-with-html security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "answer-me-with-html security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "qingyuna"
date-released: "2026-10-29"
url: "https://skillstore.io/skills/qingyuna-answer-me-with-html/audits/1"
identifiers:
  - type: other
    value: "skillstore:qingyuna-answer-me-with-html:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Explain Request Flows

Show request paths, service relationships, and state changes with diagrams and selected code excerpts.

Compare Product Options

Present decision criteria, trade-offs, and open questions in a visual comparison page.

Prepare Technical Lessons

Convert a structured lesson into scenes with diagrams, captions, and explicitly selected narration.

Попробуйте эти промпты

Create a First Explainer

Explain [topic] as one HTML page with a conclusion, one diagram, and a short comparison table. Do not open the browser automatically.

Compare Alternatives

Compare [option A] and [option B] across [criteria]. Create an HTML page with evidence, trade-offs, and one decision question.

Document Existing Architecture

Explain [workspace subsystem] with a request-flow diagram and selected code excerpts. Cite real files and identify private content before sharing the HTML.

Build an Offline Lesson

Create a four-scene video explaining [process]. Use recurring diagram labels, subtitles, and voice off. Keep the player local and report export prerequisites.

Лучшие практики

Use one question per panel and place the core conclusion before supporting evidence.
Review embedded code and images before sharing a page or enabling network access.
Select voice off or system speech for private narration unless cloud processing is explicitly approved.

Избегать

Do not use charts with invented numbers or present sketches as verified project code.
Do not treat reader comments or unanswered suggested options as authorization to run commands.
Do not send credentials through remote HTTP speech endpoints or share private page links over untrusted networks.

Часто задаваемые вопросы

Which assistants can use this skill?

The instructions cover Claude, Claude Code, and Codex. Hosts without CLAUDE_SKILL_DIR substitution must use the actual skill directory path.

Does page generation need dependency installation?

The bundled CLI needs Node.js 20 or newer. Ordinary page rendering does not require installing additional Node packages.

Where are generated pages stored?

Pages normally use the application data directory. Output flags can select a workspace file, and restricted writes can trigger private temporary storage.

Does it work without network access?

Local page rendering can work offline. Disable update checks and avoid remote themes and cloud narration when network access is prohibited.

Can narration send text to external services?

Yes. Auto voice selects ElevenLabs when its API key exists. Use voice off or system speech to avoid that cloud upload.

Can I safely share every generated page?

No. Review embedded content first. Optional LAN sharing uses HTTP, and anyone holding a valid page link can access that page.