技能 hairline-create

📦

hairline-create

Name: hairline-create
Author: lucasmarkes

内容修订 r1 中风险 ⚙️ 外部命令⚡ 包含脚本📁 文件系统访问🔑 环境变量🌐 网络访问

Create Interactive Hairline Figures

Interactive line illustrations require consistent geometry, motion, and visual checks. This skill guides concept selection, builds a standalone HTML figure, and checks its structure and appearance.

支持: Claude Codex Code(CC)

📊 70 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "hairline-create" from https://skillstore.io/skills/lucasmarkes-hairline-create.md and its manifest at https://skillstore.io/api/skills/lucasmarkes-hairline-create/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/lucasmarkes-hairline-create.md 已签名 manifest GET /api/skills/lucasmarkes-hairline-create/manifest 已签名 lockfile GET /api/skills/lucasmarkes-hairline-create/lockfile

测试它

正在使用“hairline-create”。 Suggest a Hairline metaphor for a deployment pipeline.

预期结果:

Locks: stepped canal basins open in sequence from the selected lock; the readout names its stage.
Marble run: hovering slows rolling marbles so the selected ramp can be inspected.
Cabinet: nearby server blades slide outward as the pointer selects an update position.

正在使用“hairline-create”。 Build the supplied Riffle example and describe its interaction.

预期结果:

A standalone HTML page shows eight cards in a rounded tray. The selected card rises, neighboring cards lean away, and the slider controls stagger timing.

正在使用“hairline-create”。 Describe the visual inspection deliverables for a completed figure.

预期结果:

A labeled PNG sheet compares eight states, including thumbnails, slider extremes, and dark and light themes.
The inspection reports frame bounds, readouts, console messages, and settling observations.
Unverified visual checks are disclosed when no browser is available.

安全审计

中风险

v1 • 2026/10/4 打开版本化报告

Most static matches are benign JavaScript syntax, documentation, CSS, or intended local file operations. Automatic npm installation exposes the host to mutable dependencies and enabled lifecycle scripts, while browser inspection lacks network isolation. No evidence found of credential theft, malicious supplied figures, or audit-directed prompt injection.

已扫描文件

1,859

分析行数

复核项

已忽略误报

已确认安全问题 (1)

中

validate.mjs:89-93 look.mjs:111-112 look.mjs:133-138

Browser Inspection Lacks Network Isolation

The validator rejects literal API names, but does not establish a security boundary for JavaScript. Accepted figures execute without network blocking, so computed API access can reach external or local network services.

Source inspection shows regex-based API rejection and page navigation without request blocking. No evidence found of actual exfiltration or malicious supplied figures.

能力复核项 (2)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

look.mjs:26

Node.js child_process module

import { spawnSync } from "node:child_process";

The imported spawnSync is used at line 78 for automatic npm installation. Mutable dependency resolution and enabled lifecycle scripts expose the host to supply-chain execution.

高

look.mjs:78

Synchronous spawn

const run = spawnSync(win ? "npm.cmd" : "npm", ["install", "playwright-core@1", "--prefix", dir, "--

spawnSync automatically installs playwright-core@1 without disabling npm lifecycle scripts. A compromised dependency or existing cache manifest can execute host commands during installation.

风险因素

⚙️ 外部命令 (50)

⚡ 包含脚本 (9)

build.mjs:25 look.mjs:79 look.mjs:179 validate.mjs:138 validate.mjs:142 validate.mjs:166 validate.mjs:167 validate.mjs:180 validate.mjs:185

📁 文件系统访问 (28)

🔑 环境变量 (1)

look.mjs:56

🌐 网络访问 (1)

validate.mjs:89

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/lucasmarkes-hairline-create/security.svg)](https://skillstore.io/skills/lucasmarkes-hairline-create?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/lucasmarkes-hairline-create?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lucasmarkes-hairline-create/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/lucasmarkes-hairline-create.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

lucasmarkes. (2026). hairline-create security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1

BibTeX 引用

@techreport{lucasmarkes-lucasmarkes-hairline-create-2026,
  author = {lucasmarkes},
  title = {hairline-create security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "hairline-create security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "lucasmarkes"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/lucasmarkes-hairline-create/audits/1"
identifiers:
  - type: other
    value: "skillstore:lucasmarkes-hairline-create:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Prototype a Pointer Interaction

Explore how a tray, stack, or field responds to pointer movement before adapting the interaction to a product.

Build a Shareable Illustration

Create a standalone HTML line figure with theme switching, an intensity slider, and no runtime external assets.

Explain a Process Through an Object

Translate a process into a recognizable physical metaphor with one gesture and a short readout.

试试这些提示

Choose a Concept

Suggest three Hairline concepts for [idea]. Describe each object, pointer response, and short readout. Wait for my choice before building.

Create a Figure

Create a Hairline figure of [object] that [pointer action]. Use the supplied engine and page, then validate the HTML. Ask before installing dependencies.

Inspect Every State

Inspect [figure file] using [answer point] and [edge points]. Capture the eight views, report failures, and inspect the sheet. Ask before installing dependencies.

Refine Without Changing the Engine

Refine [figure file] to [requested change]. Edit only the figure, preserve stable hit areas, rerun validation, and disclose unverified checks. Ask before installing dependencies.

最佳实践

Choose one recognizable object, one pointer gesture, and a composed rest pose before writing the figure.
Keep the engine and page unchanged, and review dependency installation before running browser inspection.
Validate after every edit, inspect all eight views, and disclose any checks that could not be performed.

避免

Modify the engine or page template to work around a figure problem.
Add labels, icons, custom colors, or independent animation timers inside the drawing.
Treat a passing text validator as proof of visual quality or security isolation.