技能 ckm-design-system
📦
ckm-design-system
v1.0.0 内容修订 r1 中风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问🔑 环境变量⚡ 包含脚本
构建由令牌驱动的设计系统
当令牌、组件和演示资产被分开处理时，设计系统会逐渐偏离一致性。此技能提供令牌架构、验证器和幻灯片辅助工具，以实现一致的落地实施。
支持: Claude Codex Code(CC)
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "ckm-design-system" from https://skillstore.io/skills/nextlevelbuilder-ckm-design-system.md and its manifest at https://skillstore.io/api/skills/nextlevelbuilder-ckm-design-system/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“ckm-design-system”。 请求为仪表盘产品制定令牌计划。
预期结果:
- 一份三层令牌图谱，涵盖原始值、语义别名和组件专用令牌。
- 针对颜色、排版、间距、阴影和交互状态的推荐命名规则。
正在使用“ckm-design-system”。 请求对前端文件夹进行令牌合规性审查。
预期结果:
- 一份本地审计摘要，列出硬编码颜色、像素值和 rem 值。
- 建议使用颜色、间距、圆角和排版令牌族进行替换。
正在使用“ckm-design-system”。 请求制定品牌化演示文稿计划。
预期结果:
- 按幻灯片逐页规划的结构，包含推荐版式、文案公式、图表类型和情绪节奏。
- 关于符合令牌规范的幻灯片样式和背景图片选择的指导。
安全审计
中风险v4 • 2026/7/5 打开版本化报告
Most static findings are false positives from Markdown code fences, JavaScript template literals, CSV design vocabulary, dictionary key access, and fixed public resource URLs. Confirmed issues are local filesystem write/read risks in the token generator plus semantic risks in slide generation: unescaped HTML content and unrestricted output paths. No prompt-injection attempt was found in the reviewed skill files.
26
已扫描文件
4,805
分析行数
6
复核项
0
已忽略误报
已确认安全问题 (2)
中
Unescaped Slide Content In Generated HTML
Slide fields from input data are inserted directly into HTML templates. Untrusted JSON can inject HTML or scripts into generated decks opened in a browser.
The generator reads slide JSON and interpolates values such as title, subtitle, and CTA text directly into HTML strings. I did not see escaping or sanitization before write_text emits the deck.
中
Unrestricted Slide Output Path
The slide generator accepts --output as a path and writes to it without restricting the destination. Prompt-controlled arguments could overwrite writable files outside the intended slide directory.
args.output is converted directly to a Path, its parent directory is created, and HTML is written there. The risk depends on invocation context, so confidence is high but not absolute.
能力复核项 (6)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Node.js fs operations
const tokens = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
The token generator reads a user-supplied config path with no workspace restriction. This is expected CLI behavior, but it can read arbitrary accessible JSON files when invoked with unsafe arguments.
中
Node.js fs operations
fs.mkdirSync(path.dirname(outputPath), { recursive: true });
The --output argument is resolved directly and its parent directory is created recursively. Without output path restrictions, a prompt-controlled invocation could create directories outside the intended project area.
中
Node.js fs operations
fs.writeFileSync(outputPath, output);
The script writes generated content to a user-supplied output path without restricting it to a known output directory. This can overwrite arbitrary writable files if invoked with unsafe arguments.
中
Node.js fs stat operations
if (!fs.existsSync(configPath)) {
The script resolves the --config value from process.cwd() and checks that path without constraining it to the project. This is user-directed, but it still allows probing arbitrary accessible paths if unsafe arguments are supplied.
中
Synchronous file operations
const tokens = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
The same user-supplied config path is read synchronously and is not limited to a safe directory. The risk is local file exposure through misuse rather than hidden exfiltration.
中
Synchronous file operations
fs.writeFileSync(outputPath, output);
The synchronous write uses the unrestricted --output path. The issue is not command execution, but unintended local file overwrite when arguments are not trusted.
风险因素
⚙️ 外部命令 (76)
scripts/embed-tokens.cjs:77 scripts/embed-tokens.cjs:90 scripts/embed-tokens.cjs:92 scripts/embed-tokens.cjs:97 scripts/generate-tokens.cjs:32-40 scripts/generate-tokens.cjs:109-114 scripts/generate-tokens.cjs:114-119 scripts/generate-tokens.cjs:119-124 scripts/generate-tokens.cjs:124-126 scripts/generate-tokens.cjs:129-132 scripts/generate-tokens.cjs:132-134 scripts/generate-tokens.cjs:151 scripts/generate-tokens.cjs:155-161 scripts/generate-tokens.cjs:179 scripts/generate-tokens.cjs:199 scripts/slide-token-validator.py:30 scripts/validate-tokens.cjs:33-46 scripts/validate-tokens.cjs:180 scripts/validate-tokens.cjs:190 scripts/validate-tokens.cjs:192 scripts/validate-tokens.cjs:193 scripts/validate-tokens.cjs:194 scripts/validate-tokens.cjs:195 scripts/validate-tokens.cjs:205 scripts/validate-tokens.cjs:207 scripts/validate-tokens.cjs:227 scripts/validate-tokens.cjs:231 SKILL.md:27 SKILL.md:31-37 SKILL.md:37-40 SKILL.md:40-49 SKILL.md:49-54 SKILL.md:54-56 SKILL.md:56-59 SKILL.md:59-61 SKILL.md:61-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-88 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91-92 SKILL.md:92-98 SKILL.md:98-116 SKILL.md:116-117 SKILL.md:117-118 SKILL.md:118-119 SKILL.md:119-123 SKILL.md:123-134 SKILL.md:134-140 SKILL.md:140-141 SKILL.md:141-142 SKILL.md:142-143 SKILL.md:143-144 SKILL.md:144-145 SKILL.md:145-146 SKILL.md:146-147 SKILL.md:147-151 SKILL.md:151-166 SKILL.md:166-171 SKILL.md:171-173 SKILL.md:173-180 SKILL.md:180-181 SKILL.md:181 SKILL.md:189-208 SKILL.md:208-212 SKILL.md:212-222 SKILL.md:222-227 SKILL.md:227-229 SKILL.md:229-233 SKILL.md:233-235
📁 文件系统访问 (15)
scripts/embed-tokens.cjs:86 scripts/embed-tokens.cjs:20 scripts/embed-tokens.cjs:86 scripts/generate-slide.py:632 scripts/generate-tokens.cjs:184 scripts/generate-tokens.cjs:197 scripts/generate-tokens.cjs:198 scripts/generate-tokens.cjs:178 scripts/generate-tokens.cjs:184 scripts/generate-tokens.cjs:198 scripts/validate-tokens.cjs:99 scripts/validate-tokens.cjs:130 scripts/validate-tokens.cjs:226 scripts/validate-tokens.cjs:130 scripts/validate-tokens.cjs:231
🌐 网络访问 (28)
scripts/fetch-background.py:144 scripts/fetch-background.py:145 scripts/fetch-background.py:146 scripts/fetch-background.py:149 scripts/fetch-background.py:150 scripts/fetch-background.py:151 scripts/fetch-background.py:154 scripts/fetch-background.py:155 scripts/fetch-background.py:156 scripts/fetch-background.py:159 scripts/fetch-background.py:160 scripts/fetch-background.py:163 scripts/fetch-background.py:164 scripts/fetch-background.py:167 scripts/fetch-background.py:168 scripts/fetch-background.py:171 scripts/fetch-background.py:172 scripts/fetch-background.py:175 scripts/fetch-background.py:176 scripts/fetch-background.py:179 scripts/fetch-background.py:180 scripts/fetch-background.py:183 scripts/fetch-background.py:184 scripts/fetch-background.py:197 scripts/generate-slide.py:32 scripts/generate-slide.py:33 SKILL.md:190 templates/design-tokens-starter.json:2
🔑 环境变量 (6)
⚡ 包含脚本 (1)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/nextlevelbuilder-ckm-design-system?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/nextlevelbuilder-ckm-design-system?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nextlevelbuilder-ckm-design-system/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/nextlevelbuilder-ckm-design-system.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
nextlevelbuilder. (2026). ckm-design-system security audit report (audit version 4) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4BibTeX 引用
@techreport{nextlevelbuilder-nextlevelbuilder-ckm-design-system-2026,
author = {nextlevelbuilder},
title = {ckm-design-system security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ckm-design-system security audit report (audit version 4)"
version: "1.0.0"
type: report
authors:
- name: "nextlevelbuilder"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/nextlevelbuilder-ckm-design-system/audits/4"
identifiers:
- type: other
value: "skillstore:nextlevelbuilder-ckm-design-system:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 高 68
架构
100
可维护性
87
内容
67
社区
83
规范符合性
你能构建什么
创建令牌架构
在团队实现主题、状态和变体之前，定义基础、语义和组件令牌。
审计令牌合规性
扫描本地源文件和 HTML 资产，查找应使用设计令牌的硬编码值。
规划品牌化演示文稿
使用幻灯片策略、版式、文案、图表和背景参考资料来规划一致的演示文稿。
试试这些提示
启动令牌系统
使用 ckm-design-system 为 SaaS 仪表盘梳理基础、语义和组件令牌。包括颜色、排版、间距、圆角和状态令牌。
验证现有 UI
使用 ckm-design-system 检查我的 src 目录中是否存在硬编码的设计值。总结违规项，并建议对应的令牌类别。
生成令牌输出
使用 ckm-design-system 将我的 token JSON 转换为 CSS 变量和 Tailwind 颜色扩展。将输出保留在项目 assets 目录内。
设计路演文稿系统
使用 ckm-design-system 规划一份 10 页投资人演示文稿，包含策略、版式、排版、颜色处理、图表选择和符合令牌规范的 HTML 输出。
最佳实践
- 将基础值与语义别名和组件令牌分开维护。
- 在审查或分享生成输出之前，先在可信的项目文件夹上运行验证器。
- 将生成的幻灯片和令牌文件保存在可预测的资产目录中。
避免
- 不要将不可信的 HTML 或脚本粘贴到用于生成的幻灯片数据中。
- 不要使用绝对路径或父目录遍历来运行会写入文件的辅助工具。
- 不要在生产组件中混用原始 hex 值和令牌引用。
常见问题
此技能可以创建完整的设计系统吗？
它可以提供令牌架构、示例、验证器和生成辅助工具。它仍然需要特定于产品的设计决策和审查。
它支持 Tailwind 吗？
可以。令牌生成器可以根据语义令牌值生成 Tailwind 颜色配置。
它可以自动验证我的代码吗？
它包含用于源文件和 HTML 资产的本地验证器。请先审查结果，再进行更改。
它可以生成幻灯片吗？
可以。它可以根据结构化幻灯片数据和基于令牌的模板生成 HTML 幻灯片。
它需要网络访问吗？
大多数工具都在本地运行。生成的幻灯片或示例可能会引用 Google Fonts、Pexels 图片或 Chart.js CDN 资源。
它对不可信内容安全吗？
请谨慎处理不可信的幻灯片数据。幻灯片生成器会将文本插入 HTML，在分享前应进行清理。