Versioned security assessment
Report ID: SA-1FFA7643
7/9/2026, 4:24:54 AM
ckm-design security assessment v4
Skill Security Certification Report
Audit model: claude Historical report
- Skill name
- ckm-design
- Version
- v4
- Maintainer
- nextlevelbuilder
- Coverage
- 35 Files scanned · 5,279 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
14 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The audit found no evidence of malware, prompt-injection text, or covert host reconnaissance. Most static hits are false positives from Markdown examples and design terminology, but the skill does read environment variables, loads .env files from user-home locations, writes generated files, and sends design inputs to Gemini APIs.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
35 Files scanned · 5,279 Lines analyzed
42 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 4 evidence locations
Filesystem access
May read or write local files.
Observed in 34 evidence locations
Env variables
May read values from the process environment.
Observed in 27 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 50 evidence locations
Capability review items (28)
High
Generic API/secret keys
api_key = os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=api_key)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
High
Generic API/secret keys
client = genai.Client(api_key=GEMINI_API_KEY)
The script retrieves an API key from the environment and passes it to a Gemini client. That is legitimate functionality but still grants the skill access to secret credentials.
Medium
Python file write/append
with open(filepath, "wb") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python file write/append
with open(output_path, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python file write/append
with open(filepath, "w", encoding="utf-8") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Medium
Python file write/append
with open(output_path, "wb") as f:
The script writes generated image or HTML output to a filesystem path. This is expected behavior, but user-controlled output paths can overwrite files if not constrained.
Medium
Python os file operations
os.makedirs(output_dir, exist_ok=True)
The script creates output directories on the local filesystem. This is normal for asset generation, but it is still a filesystem mutation risk if paths are not constrained.
Low
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Low
Hardcoded URL
<div class="slide slide-with-bg" style="background-image: url('https://images.pexels.com/...')">
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family={FONT}&display=swap" rel="stylesheet">
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Low
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
api_key = os.environ.get("GEMINI_API_KEY") or os.environ.get("GOOGLE_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
if key not in os.environ:
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
os.environ[key] = value.strip('"\'')
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Python environment access
GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY")
The script reads or sets environment variables for API configuration. This is expected for Gemini usage but remains a real environment-access risk in a community skill.
Low
Hardcoded URL
export GEMINI_API_KEY="your-key" # https://aistudio.google.com/apikey
The skill references external web resources such as CDNs, fonts, image URLs, or API-key setup pages. These are not malicious, but they introduce external network dependencies.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (14)
RISK-001 High
Environment file access
"""Load environment variables from .env files"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-002 High
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-003 High
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-004 High
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-005 High
Environment file access
"""Load .env files in priority order"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-006 High
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-007 High
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-008 High
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-009 High
Environment file access
"""Load .env files in priority order"""
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-010 High
Environment file access
Path(__file__).parent.parent.parent / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-011 High
Environment file access
Path.home() / ".claude" / "skills" / ".env",
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-012 High
Environment file access
Path.home() / ".claude" / ".env"
The generator loads .env files, including paths under the user home directory. This can expose local secrets to a community skill and should require explicit user consent.
RISK-013 High
Third-party AI API processing of user design inputs
The logo, CIP, and icon generators initialize Gemini clients with local API keys. User prompts, brand details, logos, or generated assets may be sent to a third-party AI service as part of normal operation.
The static findings show Gemini client initialization with environment API keys in all three generators. The skill purpose is image and design generation, so user design inputs are likely processed externally.
RISK-014 Medium
Workflow encourages external browsing and tool delegation
The banner and social workflow instructs the assistant to browse Pinterest and invoke external design or browser tooling. This can disclose user-provided campaign details or brand assets outside the local environment.
The referenced workflow text explicitly includes browsing and tool delegation steps. The risk depends on user content, but the instruction is clear and not captured by simple static URL matching.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighAutomatic .env loading from user-home pathsRemove implicit reads of ~/.claude/.env and ~/.claude/skills/.env, or require explicit user confirmation before loading secrets outside the skill directory.
- FIX-002HighThird-party AI API processingClearly disclose that prompts, brand information, logos, and generated assets may be sent to Gemini, and ask before sending sensitive client materials.
- FIX-003MediumFilesystem writes for generated assetsConstrain output paths to a user-approved project directory and refuse path traversal or absolute paths unless the user explicitly approves them.
- FIX-004LowExternal network resources in templates and workflowsPrefer bundled local assets for templates, and disclose when CDN fonts, images, browsing, or external web resources will be used.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: claude
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable