Skills ckm-brand

📦

ckm-brand

Name: ckm-brand
Author: nextlevelbuilder

v1.0.0 Content revision r1 Medium Risk 📁 Filesystem access🌐 Network access⚡ Contains scripts⚙️ External commands

Build Brand Guidelines and Asset Workflows

Brand work often drifts across voice, visuals, assets, and design tokens. This skill helps Claude, Codex, and Claude Code create, review, and apply consistent brand systems.

Supports: Claude Codex Code(CC)

📊 74 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "ckm-brand" from https://skillstore.io/skills/nextlevelbuilder-ckm-brand.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-ckm-brand/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/nextlevelbuilder-ckm-brand.md Signed manifest GET /api/skills/nextlevelbuilder-ckm-brand/manifest Signed lockfile GET /api/skills/nextlevelbuilder-ckm-brand/lockfile

Test it

Using "ckm-brand". A founder needs a first brand guide for a new analytics product.

Expected outcome:

A structured guide with voice traits, core messages, color roles, typography, logo rules, imagery direction, and approval checkpoints.

Using "ckm-brand". A designer asks why a campaign banner feels off-brand.

Expected outcome:

A review that flags color drift, inconsistent typography, weak voice alignment, and practical fixes before publication.

Using "ckm-brand". A developer needs to update design tokens from approved brand colors.

Expected outcome:

A sync plan that identifies guideline sources, token destinations, dry-run checks, and review steps for changed files.

Security Audit

Medium Risk

v6 • 7/9/2026 Open versioned report

Most static findings are false positives from Markdown code fences, JavaScript template literals, regular-expression exec calls, and expected local filesystem checks. A real issue remains in scripts/sync-brand-to-tokens.cjs, which imports child_process and runs execSync with a shell command string. The prompt-context helper also needs guardrails before placing local brand text into model prompts.

Files scanned

3,264

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

scripts/inject-brand-context.cjs:271-304 scripts/inject-brand-context.cjs:328-345

Prompt Context Built From Local Markdown Without Injection Guardrails

The context generator reads local brand guidelines and places extracted values into a prompt addition without neutralizing instruction-like text. This is an AI prompt-injection surface if the guideline file contains hostile instructions.

The code directly builds BRAND CONTEXT prompt text from values extracted from a local file and prints it for model use. I found no malicious bundled instructions, so this is a guardrail gap rather than an active attack.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/sync-brand-to-tokens.cjs:14

Node.js child_process module

const { execSync } = require('child_process');

The script imports child_process and later uses execSync to run a generated shell command. That creates a real external command execution surface in a community skill.

High

scripts/sync-brand-to-tokens.cjs:253

Synchronous process execution

execSync(`node ${generateScript} --config ${DESIGN_TOKENS_JSON} -o ${DESIGN_TOKENS_CSS}`, {

execSync runs a shell command string built from local paths without an argument array or quoting. A workspace path with shell metacharacters could alter the executed command.

High

scripts/sync-brand-to-tokens.cjs:253

Ruby/shell backtick execution

execSync(`node ${generateScript} --config ${DESIGN_TOKENS_JSON} -o ${DESIGN_TOKENS_CSS}`, {

This template literal is the command string passed into execSync on the same line. The shell execution risk is real because paths are interpolated into one command string.

Risk Factors

📁 Filesystem access (25)

🌐 Network access (4)

references/typography-specifications.md:22 references/typography-specifications.md:23 templates/brand-guidelines-starter.md:86 templates/brand-guidelines-starter.md:87

⚡ Contains scripts (1)

scripts/extract-colors.cjs:84

⚙️ External commands (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/nextlevelbuilder-ckm-brand/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/nextlevelbuilder-ckm-brand/security.svg)](https://skillstore.io/skills/nextlevelbuilder-ckm-brand?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/nextlevelbuilder-ckm-brand?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-ckm-brand/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-ckm-brand.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

nextlevelbuilder. (2026). ckm-brand security audit report (audit version 6) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-ckm-brand/audits/6

BibTeX citation

@techreport{nextlevelbuilder-nextlevelbuilder-ckm-brand-2026,
  author = {nextlevelbuilder},
  title = {ckm-brand security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/nextlevelbuilder-ckm-brand/audits/6},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ckm-brand security audit report (audit version 6)"
version: "1.0.0"
type: report
authors:
  - name: "nextlevelbuilder"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/nextlevelbuilder-ckm-brand/audits/6"
identifiers:
  - type: other
    value: "skillstore:nextlevelbuilder-ckm-brand:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a New Brand System

Define voice, color, typography, logo rules, and messaging for a new product launch.

Review Campaign Assets

Check campaign copy, visuals, and file names against established brand rules before publication.

Sync Brand Colors to Tokens

Translate approved brand colors into token files used by product interfaces.

Try These Prompts

Create Starter Guidelines

Create a starter brand guide for [product]. Include voice traits, color roles, typography, logo rules, imagery, and asset naming.

Review Brand Consistency

Review this content for brand consistency. Compare tone, vocabulary, visual direction, and calls to action against the supplied guidelines.

Define Asset Governance

Design an asset governance workflow for [team]. Include naming rules, folder structure, approval states, metadata, and validation checks.

Prepare Design Token Sync

Map approved brand colors and typography into design token updates. Identify source guideline sections, destination tokens, risks, and review steps.

Best Practices

Keep docs/brand-guidelines.md current before running context or token scripts.
Review generated naming and asset suggestions before changing shared files.
Confirm color contrast and font licensing outside the skill before publishing.

Avoid

Do not treat placeholder template values as approved brand standards.
Do not run sync scripts in repositories without reviewing pending token changes.
Do not paste confidential brand strategy into prompts unless your tool policy allows it.