Skills impeccable

📦

impeccable

Name: impeccable
Author: pbakaus

v3.9.1 Content revision r2 Critical 🔑 Env variables⚙️ External commands🌐 Network access📁 Filesystem access⚡ Contains scripts

Improve Production Frontend Interfaces

Frontend work often lacks consistent design reasoning, accessibility checks, and responsive polish. This skill provides focused workflows that inspect, implement, and refine real interfaces.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

This skill is part of a pack

Install the whole pack to get every skill the task needs, in one command.

KeywayTech Coding Skills · 19 skills Install whole pack

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "impeccable" from https://skillstore.io/skills/pbakaus-impeccable.md and its manifest at https://skillstore.io/api/skills/pbakaus-impeccable/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/pbakaus-impeccable.md Signed manifest GET /api/skills/pbakaus-impeccable/manifest Signed lockfile GET /api/skills/pbakaus-impeccable/lockfile

Test it

Using "impeccable". Audit the account settings page before release.

Expected outcome:

Priority: Fix unlabeled controls and insufficient text contrast before release.
Responsive issue: The action row overflows at narrow widths.
Polish item: Align field descriptions and error messages to one spacing scale.

Using "impeccable". Make this dashboard quieter without losing hierarchy.

Expected outcome:

Reduced competing accent colors and reserved emphasis for primary actions.
Simplified repeated card treatments while preserving comparison structure.
Adjusted typography and spacing to improve scanning at desktop and mobile sizes.

Using "impeccable". Improve onboarding for a first-time workspace owner.

Expected outcome:

A revised onboarding flow with clear progress, useful empty states, recovery paths, and responsive implementation aligned with the existing product design.

Security Audit

Critical

v6 • 7/23/2026 Open versioned report

Most static matches are lexical false positives from design prose, regular-expression calls, readable detector code, and a disclosed minified screenshot dependency. Confirmed risks include automatic network access, disabled browser sandboxing in CI, shell command injection through crafted paths, credential-bearing subprocesses, and a live server whose token and privileged agent workflows are exposed across origins. Static review was capped at 400/2770 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

Files scanned

50,713

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (7)

Critical

multiple:1

[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access

This combination is common in credential stealers and RATs

The skill launches network-capable AI CLIs with approval and sandbox bypass while forwarding credential-bearing environment variables, so this dangerous combination is real.

Critical

scripts/live-server.mjs:388-417 scripts/live-server.mjs:549-608

Live Server Exposes Its Bearer Token Across Origins

The loopback server enables wildcard CORS and serves live.js without authentication while embedding the bearer token. Any reachable origin can recover the token and call protected file-reading or source-edit orchestration endpoints.

The request handler explicitly sets Access-Control-Allow-Origin to *, and assembleLiveBrowserScript receives state.token before the unauthenticated response is served.

Critical

scripts/live-copy-edit-agent.mjs:33-84 scripts/live-copy-edit-agent.mjs:448-478

Browser-Controlled Data Reaches Permission-Bypassed AI Agents

Staged browser text and DOM evidence are embedded in an agent prompt. Codex and Claude then run with approval or permission bypass and inherit the full environment, enabling prompt injection with repository and credential impact.

The prompt serializes the staged batch, and the launch arguments explicitly use dangerously-bypass-approvals-and-sandbox or bypassPermissions while forwarding env.

High

scripts/detector/engines/browser/detect-url.mjs:148

UID/GID manipulation

const launchArgs = process.env.CI ? ['--no-sandbox', '--disable-setuid-sandbox'] : [];

The detector disables Chrome sandbox and setuid-sandbox protections whenever CI is set, weakening isolation for pages processed in CI.

High

scripts/detector/engines/browser/detect-url.mjs:251

UID/GID manipulation

const launchArgs = options.launchArgs || (process.env.CI ? ['--no-sandbox', '--disable-setuid-sandbo

The detector disables Chrome sandbox and setuid-sandbox protections whenever CI is set, weakening isolation for pages processed in CI.

High

multiple:1

[HEURISTIC] SUSPICIOUS COMBINATION: Filesystem + Credentials + Network

This combination could indicate credential harvesting and exfiltration

The live copy workflow gives network-capable child agents repository access and forwards authentication variables, creating a genuine combined exposure even without malicious intent.

High

scripts/live-server.mjs:599-611

Source Endpoint Uses a Prefix-Based Path Boundary Check

The source endpoint accepts absolute paths and checks containment with string startsWith. A sibling path sharing the project directory prefix can pass and expose files outside the project to a token holder.

path.resolve accepts an absolute input, and startsWith(process.cwd()) is not component-aware. The code does not reject absolute paths before reading.

Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

scripts/lib/is-generated.mjs:16

Node.js child_process module

import { execSync } from 'node:child_process';

This module is used by the file classifier to build a shell command from a path, and JSON string quoting does not neutralize shell substitutions inside double quotes.

Critical

scripts/live-copy-edit-agent.mjs:10

Node.js child_process module

import { spawn, spawnSync } from 'node:child_process';

This import supports Codex and Claude launches that explicitly bypass approvals or permissions and inherit the full environment.

Critical

scripts/live-copy-edit-agent.mjs:484

Process spawn

const child = spawn(command, args, {

The spawn starts Codex or Claude with permission bypass flags, repository access, inherited credentials, and browser-derived edit data.

Critical

scripts/lib/is-generated.mjs:44

Synchronous process execution

execSync(`git check-ignore --quiet ${JSON.stringify(absPath)}`, {

The interpolated path is placed in an execSync shell command; command substitutions in a crafted filename remain active despite JSON.stringify quoting.

High

scripts/live-copy-edit-agent.mjs:474

Generic API/secret keys

// Forward env as-is so CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY flow

The Claude subprocess receives the entire parent environment specifically so OAuth tokens and API keys are available, exposing credentials to a permission-bypassed child process.

High

scripts/live-server.mjs:72

Net server creation (opens port)

const srv = net.createServer();

The skill creates an HTTP service on a loopback port with file-reading and source-edit orchestration endpoints; the service is security-sensitive despite loopback binding.

High

scripts/live-copy-edit-agent.mjs:253

Synchronous spawn

const validation = spawnSync(script, {

A package-defined validation script is executed with shell mode after live edits, allowing arbitrary project script commands to run under the skill process.

Medium

reference/polish.md:40

Shell command substitution

slug=$(node .rovodev/skills/impeccable/scripts/critique-storage.mjs slug "<resolved>")

The documented shell command substitutes a resolved target inside double quotes, where crafted $() or backtick content could still execute if copied literally.

Low

scripts/context.mjs:765

Fetch API call

const res = await fetch(`${UPDATE_HOST}/api/version`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS

The mandatory context script performs an automatic outbound version request to the configured update host unless the update check is disabled.

Low

scripts/context.mjs:52

Hardcoded URL

const UPDATE_HOST = (process.env.IMPECCABLE_UPDATE_HOST || 'https://impeccable.style').replace(/\/$/

The URL is the default external host used by the automatic version check, so it represents real outbound network behavior.

Risk Factors

🔑 Env variables (50)

⚙️ External commands (50)

🌐 Network access (50)

📁 Filesystem access (50)

⚡ Contains scripts (50)

Detected Patterns

[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential accessUID/GID manipulation×2

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/pbakaus-impeccable/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/pbakaus-impeccable/security.svg)](https://skillstore.io/skills/pbakaus-impeccable?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/pbakaus-impeccable?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/pbakaus-impeccable/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/pbakaus-impeccable.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

pbakaus. (2026). impeccable security audit report (audit version 6) [Author version 3.9.1]. Skillstore. https://skillstore.io/skills/pbakaus-impeccable/audits/6

BibTeX citation

@techreport{pbakaus-pbakaus-impeccable-2026,
  author = {pbakaus},
  title = {impeccable security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/pbakaus-impeccable/audits/6},
  note = {Author version 3.9.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "impeccable security audit report (audit version 6)"
version: "3.9.1"
type: report
authors:
  - name: "pbakaus"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/pbakaus-impeccable/audits/6"
identifiers:
  - type: other
    value: "skillstore:pbakaus-impeccable:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Ship a New Product Surface

Plan and implement a responsive interface that follows existing product context, brand tokens, and component conventions.

Audit an Existing Interface

Find accessibility, hierarchy, layout, performance, and responsive issues before release.

Iterate Visually in the Browser

Select live elements, annotate desired changes, compare variants, and stage copy edits for source application.

Try These Prompts

Quick Interface Review

Audit the current page for accessibility, hierarchy, spacing, and responsive issues. Prioritize the findings and fix the highest-impact problems.

Polish a Component

Polish the selected component using the existing design system. Improve states, copy, alignment, and mobile behavior without changing its product purpose.

Shape and Build a Feature

Shape this feature before implementation. Confirm the user flow, information hierarchy, visual direction, edge cases, and responsive behavior, then build the approved design.

Run Advanced Live Iteration

Start live mode for the target page. Help me select an element, define three identity-consistent variants, compare them, and apply only my approved choice.

Best Practices

Provide the exact route, component, or file to keep analysis and edits focused.
Keep PRODUCT.md, DESIGN.md, and committed design tokens current before broad redesign work.
Review live-mode changes and repository diffs before accepting generated variants or copy edits.

Avoid

Do not use the skill for backend-only work or unrelated infrastructure changes.
Do not request a broad redesign without product goals, target users, or an existing interface reference.
Do not accept automated visual output without responsive, accessibility, and interaction testing.