Skills ckm-design-system

📦

ckm-design-system

Name: ckm-design-system
Author: nextlevelbuilder

v1.0.0 Content revision r1 Medium Risk ⚙️ External commands📁 Filesystem access🌐 Network access🔑 Env variables⚡ Contains scripts

Build Token-Driven Design Systems

Design systems drift when tokens, components, and presentation assets are handled separately. This skill provides token architecture, validators, and slide helpers for consistent implementation.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "ckm-design-system" from https://skillstore.io/skills/nextlevelbuilder-ckm-design-system.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-ckm-design-system/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/nextlevelbuilder-ckm-design-system.md Signed manifest GET /api/skills/nextlevelbuilder-ckm-design-system/manifest Signed lockfile GET /api/skills/nextlevelbuilder-ckm-design-system/lockfile

Test it

Using "ckm-design-system". Request a token plan for a dashboard product.

Expected outcome:

A three-layer token map covering raw values, semantic aliases, and component-specific tokens.
Recommended naming rules for colors, typography, spacing, shadows, and interaction states.

Using "ckm-design-system". Ask for a token compliance review of a frontend folder.

Expected outcome:

A local audit summary listing hardcoded colors, pixel values, and rem values.
Suggested replacements using color, spacing, radius, and typography token families.

Using "ckm-design-system". Ask for a branded presentation plan.

Expected outcome:

A slide-by-slide structure with recommended layouts, copy formulas, chart types, and emotional pacing.
Guidance for token-compliant slide styling and background image selection.

Security Audit

Medium Risk

v4 • 7/5/2026 Open versioned report

Most static findings are false positives from Markdown code fences, JavaScript template literals, CSV design vocabulary, dictionary key access, and fixed public resource URLs. Confirmed issues are local filesystem write/read risks in the token generator plus semantic risks in slide generation: unescaped HTML content and unrestricted output paths. No prompt-injection attempt was found in the reviewed skill files.

Files scanned

4,805

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

scripts/generate-slide.py:415-420 scripts/generate-slide.py:737-745

Unescaped Slide Content In Generated HTML

Slide fields from input data are inserted directly into HTML templates. Untrusted JSON can inject HTML or scripts into generated decks opened in a browser.

The generator reads slide JSON and interpolates values such as title, subtitle, and CTA text directly into HTML strings. I did not see escaping or sanitization before write_text emits the deck.

Medium

scripts/generate-slide.py:743-745

Unrestricted Slide Output Path

The slide generator accepts --output as a path and writes to it without restricting the destination. Prompt-controlled arguments could overwrite writable files outside the intended slide directory.

args.output is converted directly to a Path, its parent directory is created, and HTML is written there. The risk depends on invocation context, so confidence is high but not absolute.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

scripts/generate-tokens.cjs:184

Node.js fs operations

const tokens = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

The token generator reads a user-supplied config path with no workspace restriction. This is expected CLI behavior, but it can read arbitrary accessible JSON files when invoked with unsafe arguments.

Medium

scripts/generate-tokens.cjs:197

Node.js fs operations

fs.mkdirSync(path.dirname(outputPath), { recursive: true });

The --output argument is resolved directly and its parent directory is created recursively. Without output path restrictions, a prompt-controlled invocation could create directories outside the intended project area.

Medium

scripts/generate-tokens.cjs:198

Node.js fs operations

fs.writeFileSync(outputPath, output);

The script writes generated content to a user-supplied output path without restricting it to a known output directory. This can overwrite arbitrary writable files if invoked with unsafe arguments.

Medium

scripts/generate-tokens.cjs:178

Node.js fs stat operations

if (!fs.existsSync(configPath)) {

The script resolves the --config value from process.cwd() and checks that path without constraining it to the project. This is user-directed, but it still allows probing arbitrary accessible paths if unsafe arguments are supplied.

Medium

scripts/generate-tokens.cjs:184

Synchronous file operations

const tokens = JSON.parse(fs.readFileSync(configPath, 'utf-8'));

The same user-supplied config path is read synchronously and is not limited to a safe directory. The risk is local file exposure through misuse rather than hidden exfiltration.

Medium

scripts/generate-tokens.cjs:198

Synchronous file operations

fs.writeFileSync(outputPath, output);

The synchronous write uses the unrestricted --output path. The issue is not command execution, but unintended local file overwrite when arguments are not trusted.

Risk Factors

⚙️ External commands (76)

📁 Filesystem access (15)

scripts/embed-tokens.cjs:86 scripts/embed-tokens.cjs:20 scripts/embed-tokens.cjs:86 scripts/generate-slide.py:632 scripts/generate-tokens.cjs:184 scripts/generate-tokens.cjs:197 scripts/generate-tokens.cjs:198 scripts/generate-tokens.cjs:178 scripts/generate-tokens.cjs:184 scripts/generate-tokens.cjs:198 scripts/validate-tokens.cjs:99 scripts/validate-tokens.cjs:130 scripts/validate-tokens.cjs:226 scripts/validate-tokens.cjs:130 scripts/validate-tokens.cjs:231

🌐 Network access (28)

🔑 Env variables (6)

scripts/fetch-background.py:208 scripts/fetch-background.py:213 scripts/fetch-background.py:214 scripts/slide_search_core.py:430 scripts/slide_search_core.py:431 scripts/slide_search_core.py:432

⚡ Contains scripts (1)

scripts/search-slides.py:10-14

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/nextlevelbuilder-ckm-design-system/security.svg)](https://skillstore.io/skills/nextlevelbuilder-ckm-design-system?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/nextlevelbuilder-ckm-design-system?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-ckm-design-system/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-ckm-design-system.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

nextlevelbuilder. (2026). ckm-design-system security audit report (audit version 4) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4

BibTeX citation

@techreport{nextlevelbuilder-nextlevelbuilder-ckm-design-system-2026,
  author = {nextlevelbuilder},
  title = {ckm-design-system security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ckm-design-system security audit report (audit version 4)"
version: "1.0.0"
type: report
authors:
  - name: "nextlevelbuilder"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4"
identifiers:
  - type: other
    value: "skillstore:nextlevelbuilder-ckm-design-system:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a Token Architecture

Define primitive, semantic, and component tokens before teams implement themes, states, and variants.

Audit Token Compliance

Scan local source files and HTML assets for hardcoded values that should use design tokens.

Plan Branded Presentations

Use slide strategy, layout, copy, chart, and background references to plan consistent presentation decks.

Try These Prompts

Start a Token System

Use ckm-design-system to outline primitive, semantic, and component tokens for a SaaS dashboard. Include color, typography, spacing, radius, and state tokens.

Validate Existing UI

Use ckm-design-system to review my src directory for hardcoded design values. Summarize violations and suggest equivalent token categories.

Generate Token Outputs

Use ckm-design-system to convert my token JSON into CSS variables and a Tailwind color extension. Keep outputs inside the project assets directory.

Design a Pitch Deck System

Use ckm-design-system to plan a 10-slide investor deck with strategy, layout, typography, color treatment, chart choices, and token-compliant HTML output.

Best Practices

Keep primitive values separate from semantic aliases and component tokens.
Run validators on trusted project folders before reviewing or sharing generated outputs.
Keep generated slides and token files in predictable asset directories.

Avoid

Do not paste untrusted HTML or scripts into slide data used for generation.
Do not run file-writing helpers with absolute paths or parent-directory traversal.
Do not mix raw hex values with token references in production components.