Skills ckm-design
📦
ckm-design
v2.1.0 Content revision r1 High Risk 📁 Filesystem access🔑 Env variables🌐 Network access⚙️ External commands
Create Complete Brand Design Assets
Design teams often need many branded assets in consistent styles and formats. This skill guides Claude, Codex, and Claude Code through logos, icons, identity mockups, banners, social images, and presentation assets.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "ckm-design" from https://skillstore.io/skills/nextlevelbuilder-ckm-design.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-ckm-design/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "ckm-design". Create logo concepts for an eco travel app.
Expected outcome:
- Three logo directions with different visual moods.
- Recommended colors and typography.
- Icon and symbol guidance for app use.
Using "ckm-design". Plan LinkedIn and Instagram launch graphics for a SaaS product.
Expected outcome:
- Platform-specific dimensions.
- Layout and copy hierarchy recommendations.
- Export checklist for image review.
Using "ckm-design". Build a CIP concept for a consulting brand.
Expected outcome:
- Suggested identity deliverables.
- Mockup scenes and usage notes.
- Presentation structure for client review.
Security Audit
High Riskv5 • 7/9/2026 Open versioned report
The audit found no evidence of malware, prompt-injection text, or covert host reconnaissance. Most static hits are false positives from Markdown examples and design terminology, but the skill does read environment variables, loads .env files from user-home locations, writes generated files, and sends design inputs to Gemini APIs.
35
Files scanned
5,279
Lines analyzed
28
Review items
0
False positives ignored
Confirmed security concerns (14)
High
Environment file access
"""Load environment variables from .env files"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
"""Load .env files in priority order"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
Show all 14 confirmed findings
High
Environment file access
"""Load .env files in priority order"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
High
Third-party AI API processing of user design inputs
The logo, CIP, and icon generators initialize Gemini clients with local API keys. User prompts, brand details, logos, or generated assets may be sent to a third-party AI service as part of normal operation.
The static findings show Gemini client initialization with environment API keys in all three generators. The skill purpose is image and design generation, so user design inputs are likely processed externally.
Medium
Workflow encourages external browsing and tool delegation
The banner and social workflow instructs the assistant to browse Pinterest and invoke external design or browser tooling. This can disclose user-provided campaign details or brand assets outside the local environment.
The referenced workflow text explicitly includes browsing and tool delegation steps. The risk depends on user content, but the instruction is clear and not captured by simple static URL matching.
Capability review items (28)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
api_key = os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=api_key)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Medium
Python file write/append
with open(filepath, "wb") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python file write/append
with open(filepath, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Medium
Python file write/append
with open(output_path, "wb") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Low
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Low
Hardcoded URL
<div class="slide slide-with-bg" style="background-image: url('https://images.pexels.com/...')">
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family={FONT}&display=swap" rel="stylesheet">
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Low
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
api_key = os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Hardcoded URL
export GEMINI_API_KEY="your-key" # https://aistudio.google.com/apikey
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Risk Factors
📁 Filesystem access (50)
references/cip-design.md:19 references/cip-design.md:26 references/cip-design.md:29 references/cip-design.md:32 references/cip-design.md:35 references/cip-design.md:42 references/cip-design.md:45 references/cip-design.md:48 references/cip-design.md:51 references/cip-design.md:54 references/cip-design.md:60 references/cip-design.md:61 references/cip-design.md:19 references/cip-design.md:26 references/cip-design.md:29 references/cip-design.md:32 references/cip-design.md:35 references/cip-design.md:42 references/cip-design.md:45 references/cip-design.md:48 references/cip-design.md:51 references/cip-design.md:54 references/cip-design.md:60 references/cip-design.md:61 references/icon-design.md:16 references/icon-design.md:17 references/icon-design.md:18 references/icon-design.md:24 references/icon-design.md:25 references/icon-design.md:31 references/icon-design.md:37 references/icon-design.md:38 references/icon-design.md:16 references/icon-design.md:17 references/icon-design.md:18 references/icon-design.md:24 references/icon-design.md:25 references/icon-design.md:31 references/icon-design.md:37 references/icon-design.md:38 references/logo-design.md:18 references/logo-design.md:25 references/logo-design.md:28 references/logo-design.md:31 references/logo-design.md:39 references/logo-design.md:40 references/logo-design.md:18 references/logo-design.md:25 references/logo-design.md:28 references/logo-design.md:31
🔑 Env variables (30)
references/cip-design.md:119 references/icon-design.md:120 references/logo-design.md:90 scripts/cip/generate.py:83 scripts/cip/generate.py:84 scripts/cip/generate.py:212 scripts/cip/generate.py:212 scripts/cip/generate.py:213 scripts/cip/generate.py:214 scripts/cip/generate.py:217 scripts/icon/generate.py:41 scripts/icon/generate.py:42 scripts/icon/generate.py:56 scripts/icon/generate.py:56 scripts/icon/generate.py:193 scripts/icon/generate.py:194 scripts/icon/generate.py:195 scripts/icon/generate.py:198 scripts/icon/generate.py:290 scripts/icon/generate.py:291 scripts/icon/generate.py:294 scripts/logo/generate.py:44 scripts/logo/generate.py:45 scripts/logo/generate.py:59 scripts/logo/generate.py:59 scripts/logo/generate.py:145 scripts/logo/generate.py:146 scripts/logo/generate.py:147 scripts/logo/generate.py:151 SKILL.md:295
🌐 Network access (4)
⚙️ External commands (50)
references/social-photos-design.md:170-181 references/social-photos-design.md:196-207 references/social-photos-design.md:138 scripts/icon/generate.py:110 scripts/icon/generate.py:124 scripts/icon/generate.py:132-133 scripts/icon/generate.py:133 scripts/icon/generate.py:138-140 scripts/icon/generate.py:140 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:33 SKILL.md:34 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:46-48 SKILL.md:48-52 SKILL.md:52-56 SKILL.md:56-62 SKILL.md:62-65 SKILL.md:65-69 SKILL.md:69 SKILL.md:77-79 SKILL.md:79-83 SKILL.md:83-88 SKILL.md:88-92 SKILL.md:92-104 SKILL.md:104-106 SKILL.md:106 SKILL.md:110-112 SKILL.md:112-120 SKILL.md:120-126 SKILL.md:126-127 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-134 SKILL.md:134 SKILL.md:136-140 SKILL.md:140-141 SKILL.md:141-142 SKILL.md:142 SKILL.md:143-185 SKILL.md:185-189 SKILL.md:189-193 SKILL.md:193-195 SKILL.md:195-199
Audited by: claude View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/nextlevelbuilder-ckm-design?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/nextlevelbuilder-ckm-design?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-ckm-design/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-ckm-design.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
nextlevelbuilder. (2026). ckm-design security audit report (audit version 5) [Author version 2.1.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5BibTeX citation
@techreport{nextlevelbuilder-nextlevelbuilder-ckm-design-2026,
author = {nextlevelbuilder},
title = {ckm-design security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5},
note = {Author version 2.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ckm-design security audit report (audit version 5)"
version: "2.1.0"
type: report
authors:
- name: "nextlevelbuilder"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/nextlevelbuilder-ckm-design/audits/5"
identifiers:
- type: other
value: "skillstore:nextlevelbuilder-ckm-design:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 68
Architecture
100
Maintainability
87
Content
67
Community
91
Spec Compliance
What You Can Build
Launch a startup brand kit
Create logo directions, color choices, icon ideas, and first presentation visuals for a new company.
Produce campaign social assets
Plan platform-specific social images, banners, and headers with consistent dimensions and visual direction.
Build client identity mockups
Generate corporate identity deliverable concepts such as business cards, letterheads, packaging, and presentation mockups.
Try These Prompts
Create a simple logo direction
Use ckm-design to propose three logo directions for a small coffee shop named Harbor Bean. Include style, color palette, and icon idea for each direction.
Design a social campaign set
Use ckm-design to plan social media images for a product launch on LinkedIn, Instagram, and X. Include dimensions, layout approach, copy hierarchy, and visual style.
Create corporate identity mockups
Use ckm-design to create a corporate identity program for a healthcare analytics company. Recommend deliverables, mockup contexts, typography style, and color usage.
Generate an integrated brand system
Use ckm-design to define a brand system for a B2B AI platform, then plan logo variants, icon style, presentation structure, banner assets, and social image templates.
Best Practices
- Provide brand name, target audience, industry, tone, and required formats before generation.
- Review all generated assets for copyright, accessibility, and brand accuracy before publishing.
- Use a dedicated output folder and confirm before sending sensitive client materials to external AI services.
Avoid
- Do not use generated logos as final trademarks without legal and originality review.
- Do not place API keys or client secrets directly in prompts, Markdown, or shared files.
- Do not run generation scripts against broad home-directory paths or untrusted output locations.
Frequently Asked Questions
Does this skill create finished brand assets?
It can generate strong draft assets and structured design directions. A human designer should review and finalize important brand work.
Does it require Gemini?
Some logo, icon, and mockup generation scripts require a Gemini or Google API key. Reference-only workflows can still guide design without generation.
Can it create assets for multiple social platforms?
Yes. It includes guidance for common platform dimensions, layout patterns, and export considerations for social and banner graphics.
Is it safe for confidential client brands?
Use caution. Gemini workflows may send prompts, brand details, or assets to an external AI service, so get approval first.
What tools work with this skill?
The report lists Claude, Codex, and Claude Code as supported tools for guided design workflows.
What should I check before publishing outputs?
Check accessibility, platform sizing, copyright risk, trademark risk, and whether the asset matches the intended brand voice.
Developer Details
Author
nextlevelbuilderLicense
MIT
Author version
v2.1.0
Skillstore revision
r1
Ref
1ffa7643651792ccb4bd3b15d924d2c97edff755
Maintenance freshness
7/18/2026
Usage
10 downloads · 9 views