Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

Agent skill · Audited from source

presentation

skill · iii-hq/iiiLicence not declaredAudited 31 Oct 2026 · source 5c5284905316

★ 18,877pushed today
✓SAFEGrade B · 89/100 · 31 Oct 2026 · 5c52849
18,877repo stars · whole iii-hq/iii

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 5c5284905316 and observed network access and no hard-coded secrets. What it does: Turn a tech-spec directory into an interactive, marketing-grade web presentation — built so engineers understand the design, the reader is convinced of the why, and the result is shareable in public. Use when someone…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “presentation (iii-hq/iii)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/iii-hq/presentation

Trust audit

Audit 0.4.1 · source read 31 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high1 medium3 low0 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared2 observations
  • ShellNone observedNo commands run in the source
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN1
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS1
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS2
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (4)

LOWSupply chainsupply.unpinned · base/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
clsx, marked, mermaid, react, react-dom, tailwind-merge, @tailwindcss/vite, @types/node
Why
14 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWPrompt injectionreview.misleading_scope · SKILL.md
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Never run `vercel`.
Why
The directive is a non-standard constraint that is not disclosed in the package description, deviating from typical deployment instructions.
Fix
rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWPrivilege escalation / persistencereview.unsafe_action · SKILL.md
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L2
never write a non-markdown file under `tech-specs/`.
Why
Enforces a strict limitation on file writes that is not clearly described as a safety boundary for the user's repository state.
Fix
rewrite it so the instruction says plainly what it does, and asks the user before it acts

Audit 0.4.1 · source sha 5c5284905316 · 31 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisheriii-hq GitHub organizationOwner of the repository this skill is read from
  • Source folderiii-hq/iii/skills/presentationThe exact folder we audited
  • LicenceNot declaredAs the repository states it
  • Commit pinned for this verdict5c5284905316A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Turn a tech-spec directory into an interactive, marketing-grade web presentation — built so engineers understand the design, the reader is convinced of the why, and the result is shareable in public. Use when someone…

---
name: presentation
description: >-
  Turn a tech-spec directory into an interactive, marketing-grade web
  presentation — built so engineers understand the design, the reader is
  convinced of the why, and the result is shareable in public. Use when someone
  wants a spec turned into a deck.
---

# Presentation

Turn a technical specification into an interactive, persuasive web deck —
the kind at iii.dev/roadmap/. The output is a **content layer** inside the
repo's roadmap base (the shared component library, gallery, and markdown
spec viewer that build every deck into one static site — Astro routes of the
site package in iii, a standalone Vite project in other repos):

1. helps engineers **understand** the spec — the architecture is a navigable
   map, not prose;
2. is **interactive** — steppable diagrams, a selectable system map, live
   toggles; interactivity is what makes it stick;
3. reads like **marketing** — it argues the *why*. if no one is convinced the
   work should happen, the spec has not done its job;
4. is **build-in-public ready** — each deck ships as a static page at
   `/roadmap/<slug>/`, safe to share.

## Comparable to

A product launch microsite generated from an RFC. Stripe-doc clarity meets a
keynote narrative, in a monospace drafting-sheet style.

## Activation

### Use For

- generating an interactive deck from a tech-spec directory
- refreshing or extending a presentation already generated by this skill

### Do Not Use For

- writing the spec itself — use `/tech-spec`
- static slide exports (pdf / keynote) — use a slide tool
- general UI work unrelated to a spec — use `/design`

## Load First

Read these before building (they are the law — do not re-derive them):

- `reference/design-system.md` — the locked tokens, type, motion, layout
- `reference/archetypes.md` — the interactive slide library + how to pick one
- `reference/component-standards.md` — deck-local vs promoted components, the
  promotion checklist, the registry format
- `reference/narrative-framework.md` — the persuasive arc + outline rules
- `reference/quality-bar.md` — the checklist to self-verify before finishing
- `reference/hosting.md` — the two-tree layout, the pairing contract,
  frontmatter registration, and deploy
- **per repo:** `<base>/COMPONENTS.md` — the live registry of that repo's
  shared components. It may exceed the bundled catalog; when it and
  `reference/archetypes.md` disagree, **the repo registry wins**.

The skill bundles two scaffolds:

- `template/` — one deck's **content layer** (App, sections, pages, content
  data, the spec-docs glob). Copy it per spec; everything visual comes from the
  base's shared `src/` via the `@lib` alias. You generate only content.
- `base/` — the whole per-repo presentations site: the shared component
  library + design tokens, the gallery, the md-only spec viewer, and the build
  glue (`build.mjs`, `vite.config.ts`, one `package.json`). Copy once per repo
  (in iii it already lives at `website/roadmap/`); per-deck runs never
  modify it except **additive component promotion** per
  `reference/component-standards.md`.

## Progress Updates

Emit one short line before each phase: `ingesting spec` → `reading the
component registry` → `proposing outline` → `scaffolding` → `generating slides
(k/N)` → `registering spec frontmatter` → `verifying`.

## Workflow

Phases are gated. Do not skip Phase 2's approval or Phase 5's verification.

### 0. Resolve inputs

- The argument is a tech-spec directory: `<repo>/tech-specs/<slug>/` —
  **markdown only** (README.md + domain docs; frontmatter in README.md). If
  given a path elsewhere, resolve into the spec tree or ask.
- The **slug is the spec directory's basename** (e.g. `2026-06-21-devexp` —
  `YYYY-MM-DD-<name>`; the day prefix orders the roadmap timeline). It is
  the deck directory name AND the URL segment — the pairing contract in
  `reference/hosting.md`. Fix it now and use it everywhere; never prettify it.
- Resolve the **base project**: read `<repo>/tech-specs/README.md` — the
  pointer names the base dir (in iii: `website/roadmap/`). Fallback:
  search for a dir containing both `COMPONENTS.md` and a shared `src/`.
  Detect its shape:
  - **integrated base** (shared `src/` + `scripts/manifest.mjs`, no
    package.json or build.mjs of its own — iii's shape: the site's Astro
    pages at `website/src/pages/roadmap/` render each deck's `src/App.tsx`
    as a React island via the base's `src/DeckHost.tsx`; deps live in the
    `iii-website` package) → use it, and scaffold content layers only;
  - **standalone base** (`build.mjs` + own `package.json`, one `index.html`
    per deck — the `base/` snapshot's shape) → use it;
  - **absent** → first run in this repo: pick the location with the user
    (default `website/roadmap/` when `website/` exists, else
    `roadmap/` at the repo root) and scaffold it in Phase 3;
  - **legacy layout** (`tech-specs/build.mjs` + `_gallery/` — per-deck
    standalone projects) → stop and offer the port procedure in
    `reference/hosting.md` before generating anything new.
- Output location is `<base>/<slug>/`. If it exists and is non-empty, ask:
  overwrite, update in place, or abort. **Never write a non-markdown file
  under `tech-specs/`.**
- Detect the install mode: workspace (repo `pnpm-workspace.yaml` lists the
  base) vs standalone (`pnpm install --ignore-workspace` inside the base).

### 1. Deep ingest (read, do not skim)

- Read the spec `README.md` in full first: thesis, architecture, principles,
  cross-cutting contracts, migration overview. Note whether it already has a
  frontmatter block (title/tagline/date/tags/status).
- Read every domain doc. For each, capture: the one load-bearing phrase, the
  pain it removes, the mechanism, any schema/fields, any sequence/lifecycle,
  any numbers, any honest trade-off.
- Build a **content inventory** (architecture, protocol/wire contract,
  lifecycle, state model, config schema, security, migration, ...). This is the

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 5c52849

Download folder ↗
git clone https://github.com/iii-hq/iii
git -C iii checkout 5c5284905316

The author documents no install command, so this uses the repository directly. Our verdict covers commit 5c5284905316 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 5c5284905316

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/iii-hq/presentation/badge.svg)](https://modelsatlas.com/skills/iii-hq/presentation/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

iii-sdk-reference✓SAFE

iii-hq/iii

Use when working with iii SDK APIs across Node.js, browser, Python, Rust, or Go: package installation, worker initialization, function/trigger registration, observers, invocation, local dispatch, channels, logging,…

★ 19kGrade B
iii-getting-started✓SAFE

iii-hq/iii

Install the iii engine, set up your first worker, and get a working backend running. Use when a user wants to start a new iii project, install the SDK, or needs help with initial setup and configuration.

★ 19kGrade B
iii-error-handling✓SAFE

iii-hq/iii

Handle iii engine and SDK errors across Node, Python, Rust, and browser workers. Use when interpreting error codes, retryability, RBAC denial, timeouts, handler failures, or SDK-specific exception surfaces.

★ 19kGrade B
iii-engine-config✓SAFE

iii-hq/iii

Configure a managed iii engine through worker-compose.yaml or a directly supervised engine through config.yaml. Use for engine ports, RBAC via the rbac-proxy worker, observer limits, streams, sandboxes, and…

★ 19kGrade B
iii-architecture-patterns✓SAFE

iii-hq/iii

Use when composing iii primitives into backend architectures: durable workflows, reactive backends, observer side effects, agentic pipelines, event-driven CQRS, effect pipelines, and trigger-transform-action automation.

★ 19kGrade B
iii-core-primitives✓SAFE

iii-hq/iii

Use when registering iii functions, binding triggers, observing functions, selecting sync/void/enqueue invocation, creating workers, inspecting the live worker registry, installing registry workers, authoring event…

★ 19kGrade B

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/iii-hq/presentation/badge.svg)](https://modelsatlas.com/skills/iii-hq/presentation/)

Questions about presentation

What does the presentation skill do?
Effortlessly compose, extend, and observe every service in real-time for the first time ever.
Is presentation safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can presentation access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does presentation work with?
Its documentation mentions claude-code and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (5c5284905316), read on 2026-10-31. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.