📦

brand

Name: brand
Author: nextlevelbuilder

v1.0.0 Content revision r1 Medium Risk 📁 Filesystem access🌐 Network access⚡ Contains scripts⚙️ External commands

Build consistent brand guidelines and assets

Brand work can become inconsistent across content, assets, and interfaces. This skill provides structured guidance, validation, and token synchronization to keep brand decisions aligned.

Supports: Claude Codex Code(CC)

📊 74 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "brand" from https://skillstore.io/skills/nextlevelbuilder-brand.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-brand/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/nextlevelbuilder-brand.md Signed manifest GET /api/skills/nextlevelbuilder-brand/manifest Signed lockfile GET /api/skills/nextlevelbuilder-brand/lockfile

Test it

Using "brand". Create a voice guide for a reliable payroll service.

Expected outcome:

Personality: clear, dependable, and helpful.
Tone: direct and reassuring.
Avoid: exaggerated claims and unexplained jargon.

Using "brand". Review an image asset for brand compliance.

Expected outcome:

Filename follows the campaign naming pattern.
PNG format and file size meet the defined limits.
Register the asset in the local manifest before approval.

Using "brand". Define primary and accent colors for a product interface.

Expected outcome:

Primary color: a clear blue for key actions.
Accent color: a contrasting green for success states.
Document accessible contrast checks before release.

Security Audit

Medium Risk

v1 • 9/11/2026 Open versioned report

Most static detections are false positives caused by JavaScript template literals, regular expressions, documentation, and expected local file operations. One generated ImageMagick command can be unsafe to paste when an image filename is hostile. The prompt-context generator also requires reviewed guideline inputs because it emits their content as prompt-ready instructions.

Files scanned

3,340

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

scripts/inject-brand-context.cjs:268-304 scripts/inject-brand-context.cjs:313-345

Untrusted guidelines can become prompt instructions

The context generator inserts extracted guideline fields, including a base prompt and style keywords, into prompt-ready output. A malicious or unreviewed guidelines file can therefore introduce instruction-like content into downstream AI prompts.

The generator accepts a caller-selected local guidelines path and directly interpolates extracted content into a prompt addition. This is intended functionality, but it establishes a clear trust boundary.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/extract-colors.cjs:168

Ruby/shell backtick execution

return `magick "${imagePath}" -colors ${numColors} -depth 8 -format "%c" histogram:info:`;

The script emits an ImageMagick shell command with an unescaped image path inside double quotes. A hostile filename can execute shell substitutions if a user copies and runs the displayed command.

Risk Factors

📁 Filesystem access (29)

🌐 Network access (4)

references/typography-specifications.md:22 references/typography-specifications.md:23 templates/brand-guidelines-starter.md:86 templates/brand-guidelines-starter.md:87

⚡ Contains scripts (1)

scripts/extract-colors.cjs:84

⚙️ External commands (50)

Audited by: claude

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/nextlevelbuilder-brand/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/nextlevelbuilder-brand/security.svg)](https://skillstore.io/skills/nextlevelbuilder-brand?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/nextlevelbuilder-brand?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-brand/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-brand.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

nextlevelbuilder. (2026). brand security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-brand/audits/1

BibTeX citation

@techreport{nextlevelbuilder-nextlevelbuilder-brand-2026,
  author = {nextlevelbuilder},
  title = {brand security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/nextlevelbuilder-brand/audits/1},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "brand security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
  - name: "nextlevelbuilder"
date-released: "2026-09-11"
url: "https://skillstore.io/skills/nextlevelbuilder-brand/audits/1"
identifiers:
  - type: other
    value: "skillstore:nextlevelbuilder-brand:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Define a new brand voice

Create a clear voice framework and messaging guidance for a new product launch.

Review campaign assets

Check local asset names, formats, sizes, and registration before campaign delivery.

Align interface tokens

Transfer documented brand colors into local design tokens for a product interface.

Try These Prompts

Create a brand voice

Create a concise brand voice guide for [brand]. Include personality, tone, preferred language, and prohibited terms.

Draft brand guidelines

Create brand guidelines for [brand] using [audience], [mission], [colors], and [typefaces]. Include visual and messaging standards.

Review brand consistency

Review these campaign materials against our brand guidelines. List inconsistencies, explain each issue, and recommend precise corrections.

Update design tokens

Update our brand guidelines with these color decisions, then prepare the local design-token synchronization workflow. Use a dry run first.

Best Practices

Keep one reviewed brand-guidelines file as the source of truth.
Run token synchronization with a dry run before writing project files.
Review generated brand content with the responsible brand owner.

Avoid

Do not treat generated messaging as legal or trademark advice.
Do not paste suggested shell commands for filenames you do not trust.
Do not overwrite design tokens without reviewing the proposed changes.

Frequently Asked Questions

What does this skill help with?

It supports brand voice, visual identity, messaging, asset standards, and token workflows.

Which tools can use this skill?

The package declares support for Claude, Codex, and Claude Code.

Does it analyze image pixels directly?

No. It prepares color comparison guidance and can use a separate image-analysis tool.

Can it update design tokens?

Yes. Its sync script updates local token files from documented brand colors.

Does asset validation modify files?

No. The validator reports issues and filename suggestions without renaming assets.

Should I trust injected brand context automatically?

Use only reviewed guidelines files because their content is included in prompt-ready output.

Developer Details

Author

nextlevelbuilder

License

MIT

Author version

v1.0.0

Skillstore revision

Repository

https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/tree/7f69fed6a2717900085f1bc3b263721f8ba025e2/.claude/skills/brand

Ref

ab32f1e771b01001f924c38df083d099af94056e

Maintenance freshness

9/11/2026

Usage

0 downloads · 0 views

File structure

📁 references/

📄 approval-checklist.md

📄 asset-organization.md

📄 brand-guideline-template.md

📄 color-palette-management.md

📄 consistency-checklist.md

📄 logo-usage-rules.md

📄 messaging-framework.md

📄 typography-specifications.md

📄 update.md

📄 visual-identity.md

📄 voice-framework.md

📁 scripts/

📄 extract-colors.cjs

📄 inject-brand-context.cjs

📄 sync-brand-to-tokens.cjs

📁 tests/

📄 test_sync_brand_to_tokens.py

📄 validate-asset.cjs

📄 SKILL.md

📁 templates/

📄 brand-guidelines-starter.md