Versioned security assessment

Report ID: SA-62E2A730

7/5/2026, 9:22:47 PM

ckm-design-system security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Latest published report
Skill name
ckm-design-system
Version
v1.0.0
Maintainer
nextlevelbuilder
Source
github.com/nextlevelbuilder/ui-ux-pro-max-skill/tree/main/.claude/skills/design-system/
Coverage
26 Files scanned · 4,805 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives from Markdown code fences, JavaScript template literals, CSV design vocabulary, dictionary key access, and fixed public resource URLs. Confirmed issues are local filesystem write/read risks in the token generator plus semantic risks in slide generation: unescaped HTML content and unrestricted output paths. No prompt-injection attempt was found in the reviewed skill files.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

26 Files scanned · 4,805 Lines analyzed

8 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Observed in 28 evidence locations

Filesystem access

May read or write local files.

Observed in 11 evidence locations

Env variables

May read values from the process environment.

Observed in 6 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 76 evidence locations

Capability review items (6)
Medium
scripts/generate-tokens.cjs:184
Node.js fs operations
const tokens = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
The token generator reads a user-supplied config path with no workspace restriction. This is expected CLI behavior, but it can read arbitrary accessible JSON files when invoked with unsafe arguments.
Medium
scripts/generate-tokens.cjs:197
Node.js fs operations
fs.mkdirSync(path.dirname(outputPath), { recursive: true });
The --output argument is resolved directly and its parent directory is created recursively. Without output path restrictions, a prompt-controlled invocation could create directories outside the intended project area.
Medium
scripts/generate-tokens.cjs:198
Node.js fs operations
fs.writeFileSync(outputPath, output);
The script writes generated content to a user-supplied output path without restricting it to a known output directory. This can overwrite arbitrary writable files if invoked with unsafe arguments.
Medium
scripts/generate-tokens.cjs:178
Node.js fs stat operations
if (!fs.existsSync(configPath)) {
The script resolves the --config value from process.cwd() and checks that path without constraining it to the project. This is user-directed, but it still allows probing arbitrary accessible paths if unsafe arguments are supplied.
Medium
scripts/generate-tokens.cjs:184
Synchronous file operations
const tokens = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
The same user-supplied config path is read synchronously and is not limited to a safe directory. The risk is local file exposure through misuse rather than hidden exfiltration.
Medium
scripts/generate-tokens.cjs:198
Synchronous file operations
fs.writeFileSync(outputPath, output);
The synchronous write uses the unrestricted --output path. The issue is not command execution, but unintended local file overwrite when arguments are not trusted.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Medium
scripts/generate-slide.py:415-420scripts/generate-slide.py:737-745
Unescaped Slide Content In Generated HTML
Slide fields from input data are inserted directly into HTML templates. Untrusted JSON can inject HTML or scripts into generated decks opened in a browser.
The generator reads slide JSON and interpolates values such as title, subtitle, and CTA text directly into HTML strings. I did not see escaping or sanitization before write_text emits the deck.
RISK-002 Medium
scripts/generate-slide.py:743-745
Unrestricted Slide Output Path
The slide generator accepts --output as a path and writes to it without restricting the destination. Prompt-controlled arguments could overwrite writable files outside the intended slide directory.
args.output is converted directly to a Path, its parent directory is created, and HTML is written there. The risk depends on invocation context, so confidence is high but not absolute.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Token generator accepts unrestricted config and output paths.
    Reject absolute paths and parent-directory traversal, or restrict reads and writes to approved project directories.
  2. FIX-002
    Medium
    Slide generator interpolates slide data directly into HTML.
    Escape text fields by default and allow raw HTML only through an explicit trusted-content option.
  3. FIX-003
    Medium
    Slide generator can write to arbitrary output paths.
    Default to a dedicated slides output directory and require confirmation for paths outside that directory.
  4. FIX-004
    Low
    Generated slides may load third-party fonts, images, or CDN scripts.
    Document these dependencies and provide local or self-hosted options for privacy-sensitive users.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
62e2a730c5cd74eab4c7164309d810de660fcea3
Content hash
181901810131fbf8823d6ba69890bd70eb0aa3d489811cbe7f0ada1ed361b97d
Tree hash
f740c42a0a345a53df15430354213854a6ef79cf3108c03262d83eb6441f983e
Skill path
skills/nextlevelbuilder/ckm-design-system
Audit payload hash
15bd39d53da04ecb67d26adf0b54df48

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable