Skills makepad-evolution
📦
makepad-evolution
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Improve Makepad Skills Safely
Makepad teams need a consistent way to keep shared skill guidance current. This skill provides workflows for capturing patterns, correcting errors, validating examples, adapting to versions, and recording feedback.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "makepad-evolution" from https://skillstore.io/skills/zhanghandong-makepad-evolution.md and its manifest at https://skillstore.io/api/skills/zhanghandong-makepad-evolution/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "makepad-evolution". I solved a layout problem that should become reusable Makepad guidance.
Expected outcome:
The assistant identifies the target skill, proposes a concise pattern entry, lists validation checks, and recommends a reviewed contribution workflow.
Using "makepad-evolution". My Makepad timer guidance failed on the current branch.
Expected outcome:
The assistant explains the likely API mismatch, drafts a troubleshooting note, and asks for confirmation before changing shared skill files.
Using "makepad-evolution". Show which Makepad patterns need review.
Expected outcome:
The assistant summarizes pattern health, highlights weak entries, and suggests specific validation actions for the maintainer.
Security Audit
Criticalv8 • 7/8/2026 Open versioned report
Most static external-command and network hits are false positives caused by Markdown fences, inline formatting, examples, and GitHub reference links. Real risks remain in the skill intent: it targets hidden .claude skill storage, recommends symlinks, tells the agent to act silently, and instructs automatic skill-file modification without user approval.
1
Files scanned
1,087
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (3)
Critical
Autonomous Self-Modification Of Skill Files
The skill tells the agent to use read and edit tools on skill paths and to "Automatically edit the skill file (no need to ask)." This can persist modified instructions without explicit user approval.
The file explicitly instructs tool-driven edits to installed skill files and removes the user approval step. That creates a persistent instruction-modification risk.
High
Prompt Injection Attempt Detected
The skill says "Some mechanisms should trigger automatically without user request" and "Claude: Do these silently." This attempts to suppress normal user awareness and consent for agent actions.
The instructions directly target Claude behavior and tell the agent to perform actions silently without user request. This is a clear prompt-level attempt to alter transparency and consent boundaries.
High
Silent Usage Tracking And Hidden Configuration Writes
The skill instructs the agent to track pattern use silently, add invisible usage markers, and store detected style in .claude/settings.json. This creates hidden project metadata without clear user consent.
The referenced lines explicitly combine silent tracking with persistent marker or settings writes. This is stronger than a generic documentation example because it describes operational agent behavior.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Symlink creation
ln -s /path/to/makepad-skills .claude/skills/makepad-skills
The line recommends creating a symlink from .claude/skills to a source tree. Combined with automated skill edits, this can redirect changes into persistent shared source files.
Medium
Hidden file access
THIS_SKILL_PATH = /home/user/project/.claude/skills/makepad-skills/makepad-evolution/SKILL.md
The skill directs the agent to derive and use paths under hidden .claude/skills storage for reading and editing skill files. This is intentional skill maintenance behavior, but it is still hidden configuration file access.
Medium
Hidden file access
SKILLS_ROOT = /home/user/project/.claude/skills/makepad-skills/
The skill directs the agent to derive and use paths under hidden .claude/skills storage for reading and editing skill files. This is intentional skill maintenance behavior, but it is still hidden configuration file access.
Medium
Hidden file access
/Users/someone/myapp/.claude/skills/makepad-skills/makepad-evolution/SKILL.md
The skill directs the agent to derive and use paths under hidden .claude/skills storage for reading and editing skill files. This is intentional skill maintenance behavior, but it is still hidden configuration file access.
Medium
Hidden file access
/Users/someone/myapp/.claude/skills/makepad-skills/
The skill directs the agent to derive and use paths under hidden .claude/skills storage for reading and editing skill files. This is intentional skill maintenance behavior, but it is still hidden configuration file access.
Medium
Hidden file access
/Users/someone/myapp/.claude/skills/makepad-skills/makepad-patterns/SKILL.md
The skill directs the agent to derive and use paths under hidden .claude/skills storage for reading and editing skill files. This is intentional skill maintenance behavior, but it is still hidden configuration file access.
Risk Factors
⚙️ External commands (132)
SKILL.md:44-53 SKILL.md:53-85 SKILL.md:85-93 SKILL.md:93-98 SKILL.md:98-104 SKILL.md:104-108 SKILL.md:108-111 SKILL.md:111-113 SKILL.md:113-116 SKILL.md:116-118 SKILL.md:118-119 SKILL.md:119-122 SKILL.md:122-130 SKILL.md:130-132 SKILL.md:132-133 SKILL.md:133-136 SKILL.md:136-139 SKILL.md:139-146 SKILL.md:146-147 SKILL.md:147-160 SKILL.md:160-162 SKILL.md:162-168 SKILL.md:168-178 SKILL.md:178-186 SKILL.md:186-189 SKILL.md:189-193 SKILL.md:193-215 SKILL.md:215-221 SKILL.md:221-223 SKILL.md:223-227 SKILL.md:227-233 SKILL.md:233-237 SKILL.md:237-256 SKILL.md:256-262 SKILL.md:262-270 SKILL.md:270-274 SKILL.md:274-282 SKILL.md:282-288 SKILL.md:288-301 SKILL.md:301-305 SKILL.md:305-307 SKILL.md:307-325 SKILL.md:325-331 SKILL.md:331-339 SKILL.md:339-343 SKILL.md:343-351 SKILL.md:351-355 SKILL.md:355-363 SKILL.md:363-371 SKILL.md:371-378 SKILL.md:378-387 SKILL.md:387-388 SKILL.md:388-391 SKILL.md:391-400 SKILL.md:400-408 SKILL.md:408-423 SKILL.md:423-429 SKILL.md:429-449 SKILL.md:449-461 SKILL.md:461-466 SKILL.md:466-504 SKILL.md:504-508 SKILL.md:508-533 SKILL.md:533-537 SKILL.md:537-550 SKILL.md:550-573 SKILL.md:573-577 SKILL.md:577-579 SKILL.md:579-583 SKILL.md:583-585 SKILL.md:585-586 SKILL.md:586-592 SKILL.md:592-594 SKILL.md:594-599 SKILL.md:599-604 SKILL.md:604-608 SKILL.md:608-609 SKILL.md:609-611 SKILL.md:611-616 SKILL.md:616-622 SKILL.md:622-623 SKILL.md:623-648 SKILL.md:648-652 SKILL.md:652-670 SKILL.md:670-674 SKILL.md:674-707 SKILL.md:707-713 SKILL.md:713-715 SKILL.md:715-740 SKILL.md:740-741 SKILL.md:741-748 SKILL.md:748-751 SKILL.md:751-755 SKILL.md:755-778 SKILL.md:778-784 SKILL.md:784-792 SKILL.md:792-821 SKILL.md:821-822 SKILL.md:822 SKILL.md:829-835 SKILL.md:835-842 SKILL.md:842-844 SKILL.md:844-847 SKILL.md:847-849 SKILL.md:849-855 SKILL.md:855-859 SKILL.md:859-862 SKILL.md:862-866 SKILL.md:866-869 SKILL.md:869-873 SKILL.md:873-876 SKILL.md:876-878 SKILL.md:878-882 SKILL.md:882-902 SKILL.md:902-908 SKILL.md:908-917 SKILL.md:917-959 SKILL.md:959-962 SKILL.md:962 SKILL.md:963-968 SKILL.md:968-972 SKILL.md:972-995 SKILL.md:995-1000 SKILL.md:1000-1005 SKILL.md:1005-1007 SKILL.md:1007-1008 SKILL.md:1008-1013 SKILL.md:1013-1017 SKILL.md:1017-1019 SKILL.md:1019-1029 SKILL.md:1029-1045 SKILL.md:1045-1080
🌐 Network access (3)
📁 Filesystem access (6)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/zhanghandong-makepad-evolution/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/zhanghandong-makepad-evolution?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/zhanghandong-makepad-evolution?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/zhanghandong-makepad-evolution/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/zhanghandong-makepad-evolution.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
ZhangHanDong. (2026). makepad-evolution security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/zhanghandong-makepad-evolution/audits/8BibTeX citation
@techreport{zhanghandong-zhanghandong-makepad-evolution-2026,
author = {ZhangHanDong},
title = {makepad-evolution security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/zhanghandong-makepad-evolution/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "makepad-evolution security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "ZhangHanDong"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/zhanghandong-makepad-evolution/audits/8"
identifiers:
- type: other
value: "skillstore:zhanghandong-makepad-evolution:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
70
Spec Compliance
What You Can Build
Capture Reusable Makepad Patterns
Turn a solved widget, layout, or shader problem into a structured skill entry for future projects.
Validate Shared Skill Guidance
Review Makepad examples, API references, and links before relying on them in a project.
Adapt Advice To Project Versions
Use branch and style context to shape Makepad recommendations for a specific codebase.
Try These Prompts
Beginner Pattern Capture
I found a reusable Makepad pattern. Help me describe the problem, the solution, where it belongs, and what checks are needed before adding it.
Troubleshooting Entry Review
Review this Makepad error and fix. Turn it into a clear troubleshooting entry with symptom, cause, solution, and validation steps.
Version-Aware Guidance
Analyze my Makepad dependency version and adapt the skill guidance. Explain any branch-specific API differences before suggesting changes.
Advanced Skill Maintenance Audit
Audit the Makepad skill updates I plan to make. Identify target files, duplicate content risks, validation steps, user approval points, and pull request notes.
Best Practices
- Ask for approval before changing skill files, settings files, or shared repositories.
- Validate each new pattern against the active Makepad branch before publishing it.
- Keep contributions small, sourced, and easy for maintainers to review.
Avoid
- Do not let an agent silently edit installed skill instructions.
- Do not record project usage or style data without user consent.
- Do not publish untested Makepad examples as validated guidance.
Frequently Asked Questions
What does this skill help with?
It helps maintain Makepad skill documentation by organizing evolution, correction, validation, feedback, version adaptation, and style personalization workflows.
Does it run Makepad validation automatically?
No. The skill describes validation workflows. Users should run checks and approve any changes.
Can it update skill files?
It describes how updates can be made, but safe use requires explicit user approval before any file edit.
Which tools can use it?
The report lists compatibility with Claude, Codex, and Claude Code.
Is it limited to Makepad?
Yes. The workflows are written for Makepad skills and Rust UI projects that use Makepad.
What should maintainers review first?
Maintainers should review silent automation, self-modification instructions, hidden file writes, and symlink guidance before publication.
Developer Details
Author
ZhangHanDongLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
64ca8af0f54a325752f08bd54e52151061ea659a
Maintenance freshness
7/20/2026
Usage
14 downloads · 211 views
File structure
📄 SKILL.md