技能 page
📦
page
內容修訂 r1 中風險 🌐 網路存取⚙️ 外部命令📁 檔案系統存取🔑 環境變數⚡ 包含腳本
Draft and Check a Single Landing Page Brief
Landing page drafts can lose focus when they mix offers, actions, and site inventories. This skill structures one page brief and checks its required fields locally.
支援: Claude Codex Code(CC)
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "page" from https://skillstore.io/skills/cmj-hub-page.md and its manifest at https://skillstore.io/api/skills/cmj-hub-page/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「page」。 Check a brief for https://example.com/desk offering a weekly desk review and asking readers to reply.
預期結果:
- Accepted draft. Exit code: 0.
- URL: https://example.com/desk
- Offer: A weekly desk review that identifies one priority.
- Action: Reply with the priority you want reviewed.
正在使用「page」。 Check a draft containing a sitemap marker and a list of page addresses.
預期結果:
- Rejected draft: a sitemap.
- Exit code: 1.
- Revision guidance: choose one page address and define its offer and action.
正在使用「page」。 Check a page draft with a URL and offer but no action.
預期結果:
- Rejected draft: draft is incomplete.
- Exit code: 1.
- Revision guidance: add a nonempty action string.
安全審計
中風險v1 • 2026/10/3 開啟版本化報告
Most static detections are false positives involving JavaScript templates, CSS, documentation, and local validation. Asset generators contain HTML injection vulnerabilities, external font requests, and destructive cleanup of a caller-selected frames directory. No evidence found of credential theft, malicious exfiltration, or prompt injection; the Python scorer performs local input validation.
13
已掃描檔案
702
分析行數
7
複核項目
0
已忽略的誤報
已確認的安全問題 (2)
中
Specification Data Can Escape the Inline Script
The demo embeds JSON.stringify output directly inside a script element. A specification string containing </script> can terminate that element and inject active HTML.
JSON.stringify does not escape HTML closing tags, and the serialized specification enters the script unchanged. This is separate from the detected innerHTML assignments.
中
Unvalidated Color Values Can Inject Browser Markup
Both renderers insert accent_color directly into style elements without validation. A crafted color containing </style> can inject scripts or external resource loads.
The color comes directly from parsed specification data and bypasses text escaping. The generated markup is opened in a browser during asset rendering.
能力複核項目 (7)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
中
innerHTML assignment (XSS risk)
document.getElementById('lines').innerHTML = h;
Response strings from the input specification are concatenated into h without escaping. Assigning h to innerHTML permits active markup from an untrusted specification.
中
innerHTML assignment (XSS risk)
document.getElementById('artwrap').innerHTML = (ART && t>=T_ART)
Artifact labels and lines from the specification enter innerHTML without escaping. Crafted content can inject event handlers or unwanted network requests during rendering.
中
Synchronous file operations
import { readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
rmSync recursively removes outGif + '.frames' before creating frames and again afterward. A selected output path can cause deletion of preexisting directory contents.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
The generated page preconnects to Google Fonts during rendering, exposing connection metadata to a third party. This is a low privacy risk.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
The generated page preconnects to Google's font asset host, exposing connection metadata during rendering. No credential transmission is present.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Syne:wght@700&family=DM+Sans:opsz,wght@9..40,40
The stylesheet link fetches third-party font resources during rendering and exposes request metadata. The renderer has no offline switch.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Syne:wght@700&family=DM+Sans:opsz,wght@9..40,40
The demo page fetches Google Fonts while rendering, exposing request metadata to a third party. This creates a low privacy and external-dependency risk.
風險因素
🌐 網路存取 (12)
⚙️ 外部命令 (19)
assets/card.mjs:4 assets/card.mjs:97 assets/card.mjs:21-65 assets/card.mjs:65-66 assets/card.mjs:66-87 assets/card.mjs:95 assets/card.mjs:99 assets/card.mjs:101 assets/card.mjs:107 assets/demo.mjs:5 assets/demo.mjs:116 assets/demo.mjs:15-97 SKILL.md:23 SKILL.md:33 SKILL.md:41-44 SKILL.md:44-48 SKILL.md:48 SKILL.md:54-60 tests/test_score.py:14
📁 檔案系統存取 (7)
🔑 環境變數 (2)
⚡ 包含腳本 (2)
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/cmj-hub-page/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/cmj-hub-page?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/cmj-hub-page?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cmj-hub-page/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/cmj-hub-page.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
cmj-hub. (2026). page security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cmj-hub-page/audits/1BibTeX 引用
@techreport{cmj-hub-cmj-hub-page-2026,
author = {cmj-hub},
title = {page security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/cmj-hub-page/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "page security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "cmj-hub"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/cmj-hub-page/audits/1"
identifiers:
- type: other
value: "skillstore:cmj-hub-page:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 73
架構
85
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Focus a Campaign Brief
Prepare a single destination, offer sentence, and next action before writing campaign page copy.
Define a Product Launch Page
Turn a product launch idea into a compact page brief without expanding it into a website inventory.
Check Drafts in a Local Workflow
Use the scorer's exit codes to check required draft fields and reject sitemap-shaped submissions.
試試這些提示
Create a First Page Brief
Draft one landing page brief for [product] at [URL]. Give one offer sentence and one clear action.
Improve an Existing Brief
Review this page brief: [brief]. Keep one URL, clarify the offer, and replace competing actions with one next step.
Validate a Saved Draft
Check [draft file] with the local page scorer. Explain any failure and propose edits without changing the intended offer or publishing anything.
Verify Rejection Rules
Compare [valid draft] with [sitemap draft] using the local scorer. Report exit codes and explain validation boundaries, including URL-prefix and copy-quality limitations.
最佳實務
- Keep one destination and one next step, then review the offer manually for clarity.
- Run the local scorer after revisions and review its exit code and message.
- Use trusted inputs and dedicated output locations for asset tools only after addressing the documented rendering and cleanup risks.
避免
- Submitting a sitemap or URL list instead of a single page brief.
- Treating a passing score as proof of good copy, a working URL, or a published page.
- Rendering untrusted specifications or selecting output paths whose frames directories contain valuable files.
常見問題
Which assistants can use this skill?
The marketplace lists Claude, Codex, and Claude Code. Local scoring requires access to Python 3 and the repository script.
Does the skill build or publish a landing page?
No. It guides page brief drafting and checks a local draft. Page implementation and publication remain separate tasks.
What does a passing score mean?
The draft has an HTTP or HTTPS prefix, nonempty offer and action strings, and no recognized sitemap markers.
Why does a sitemap fail?
The skill focuses on one page. The scorer rejects a sitemap kind, a urls list, or a URL containing sitemap.
Can scoring work offline?
Yes. The Python scorer uses the standard library and makes no network requests. Optional asset rendering requests Google Fonts.
Are the optional asset tools safe for untrusted input?
No. They contain HTML injection risks, and demo cleanup can delete a preexisting frames directory. Address these issues before rendering untrusted specifications.