Agent skill · Audited from source
presentation
skill · iii-hq/iiiLicence not declaredAudited 31 Oct 2026 · source 5c5284905316
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 5c5284905316 and observed network access and no hard-coded secrets. What it does: Turn a tech-spec directory into an interactive, marketing-grade web presentation — built so engineers understand the design, the reader is convinced of the why, and the result is shareable in public. Use when someone…
Cite
Cite this page
ModelsAtlas. “presentation (iii-hq/iii)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/iii-hq/presentation
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 16,667 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkDeclared2 observations
- ShellNone observedNo commands run in the source
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 1 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 2 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (4)
MEDIUMInventory / provenanceinv.symlink · sdk/packages/node/iii/local.yml
sdk/packages/node/iii/local.yml
- Why
- link not followed
- Fix
- —
LOWSupply chainsupply.unpinned · base/package.json
clsx, marked, mermaid, react, react-dom, tailwind-merge, @tailwindcss/vite, @types/node
- Why
- 14 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWPrompt injectionreview.misleading_scope · SKILL.md
Never run `vercel`.
- Why
- The directive is a non-standard constraint that is not disclosed in the package description, deviating from typical deployment instructions.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWPrivilege escalation / persistencereview.unsafe_action · SKILL.md
never write a non-markdown file under `tech-specs/`.
- Why
- Enforces a strict limitation on file writes that is not clearly described as a safety boundary for the user's repository state.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
Audit 0.4.1 · source sha 5c5284905316 · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisheriii-hq GitHub organizationOwner of the repository this skill is read from
- Source folderiii-hq/iii/skills/presentationThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict5c5284905316A new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Turn a tech-spec directory into an interactive, marketing-grade web presentation — built so engineers understand the design, the reader is convinced of the why, and the result is shareable in public. Use when someone…
---
name: presentation
description: >-
Turn a tech-spec directory into an interactive, marketing-grade web
presentation — built so engineers understand the design, the reader is
convinced of the why, and the result is shareable in public. Use when someone
wants a spec turned into a deck.
---
# Presentation
Turn a technical specification into an interactive, persuasive web deck —
the kind at iii.dev/roadmap/. The output is a **content layer** inside the
repo's roadmap base (the shared component library, gallery, and markdown
spec viewer that build every deck into one static site — Astro routes of the
site package in iii, a standalone Vite project in other repos):
1. helps engineers **understand** the spec — the architecture is a navigable
map, not prose;
2. is **interactive** — steppable diagrams, a selectable system map, live
toggles; interactivity is what makes it stick;
3. reads like **marketing** — it argues the *why*. if no one is convinced the
work should happen, the spec has not done its job;
4. is **build-in-public ready** — each deck ships as a static page at
`/roadmap/<slug>/`, safe to share.
## Comparable to
A product launch microsite generated from an RFC. Stripe-doc clarity meets a
keynote narrative, in a monospace drafting-sheet style.
## Activation
### Use For
- generating an interactive deck from a tech-spec directory
- refreshing or extending a presentation already generated by this skill
### Do Not Use For
- writing the spec itself — use `/tech-spec`
- static slide exports (pdf / keynote) — use a slide tool
- general UI work unrelated to a spec — use `/design`
## Load First
Read these before building (they are the law — do not re-derive them):
- `reference/design-system.md` — the locked tokens, type, motion, layout
- `reference/archetypes.md` — the interactive slide library + how to pick one
- `reference/component-standards.md` — deck-local vs promoted components, the
promotion checklist, the registry format
- `reference/narrative-framework.md` — the persuasive arc + outline rules
- `reference/quality-bar.md` — the checklist to self-verify before finishing
- `reference/hosting.md` — the two-tree layout, the pairing contract,
frontmatter registration, and deploy
- **per repo:** `<base>/COMPONENTS.md` — the live registry of that repo's
shared components. It may exceed the bundled catalog; when it and
`reference/archetypes.md` disagree, **the repo registry wins**.
The skill bundles two scaffolds:
- `template/` — one deck's **content layer** (App, sections, pages, content
data, the spec-docs glob). Copy it per spec; everything visual comes from the
base's shared `src/` via the `@lib` alias. You generate only content.
- `base/` — the whole per-repo presentations site: the shared component
library + design tokens, the gallery, the md-only spec viewer, and the build
glue (`build.mjs`, `vite.config.ts`, one `package.json`). Copy once per repo
(in iii it already lives at `website/roadmap/`); per-deck runs never
modify it except **additive component promotion** per
`reference/component-standards.md`.
## Progress Updates
Emit one short line before each phase: `ingesting spec` → `reading the
component registry` → `proposing outline` → `scaffolding` → `generating slides
(k/N)` → `registering spec frontmatter` → `verifying`.
## Workflow
Phases are gated. Do not skip Phase 2's approval or Phase 5's verification.
### 0. Resolve inputs
- The argument is a tech-spec directory: `<repo>/tech-specs/<slug>/` —
**markdown only** (README.md + domain docs; frontmatter in README.md). If
given a path elsewhere, resolve into the spec tree or ask.
- The **slug is the spec directory's basename** (e.g. `2026-06-21-devexp` —
`YYYY-MM-DD-<name>`; the day prefix orders the roadmap timeline). It is
the deck directory name AND the URL segment — the pairing contract in
`reference/hosting.md`. Fix it now and use it everywhere; never prettify it.
- Resolve the **base project**: read `<repo>/tech-specs/README.md` — the
pointer names the base dir (in iii: `website/roadmap/`). Fallback:
search for a dir containing both `COMPONENTS.md` and a shared `src/`.
Detect its shape:
- **integrated base** (shared `src/` + `scripts/manifest.mjs`, no
package.json or build.mjs of its own — iii's shape: the site's Astro
pages at `website/src/pages/roadmap/` render each deck's `src/App.tsx`
as a React island via the base's `src/DeckHost.tsx`; deps live in the
`iii-website` package) → use it, and scaffold content layers only;
- **standalone base** (`build.mjs` + own `package.json`, one `index.html`
per deck — the `base/` snapshot's shape) → use it;
- **absent** → first run in this repo: pick the location with the user
(default `website/roadmap/` when `website/` exists, else
`roadmap/` at the repo root) and scaffold it in Phase 3;
- **legacy layout** (`tech-specs/build.mjs` + `_gallery/` — per-deck
standalone projects) → stop and offer the port procedure in
`reference/hosting.md` before generating anything new.
- Output location is `<base>/<slug>/`. If it exists and is non-empty, ask:
overwrite, update in place, or abort. **Never write a non-markdown file
under `tech-specs/`.**
- Detect the install mode: workspace (repo `pnpm-workspace.yaml` lists the
base) vs standalone (`pnpm install --ignore-workspace` inside the base).
### 1. Deep ingest (read, do not skim)
- Read the spec `README.md` in full first: thesis, architecture, principles,
cross-cutting contracts, migration overview. Note whether it already has a
frontmatter block (title/tagline/date/tags/status).
- Read every domain doc. For each, capture: the one load-bearing phrase, the
pain it removes, the mechanism, any schema/fields, any sequence/lifecycle,
any numbers, any honest trade-off.
- Build a **content inventory** (architecture, protocol/wire contract,
lifecycle, state model, config schema, security, migration, ...). This is the
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 5c52849
git clone https://github.com/iii-hq/iii git -C iii checkout 5c5284905316
The author documents no install command, so this uses the repository directly. Our verdict covers commit 5c5284905316 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
5c5284905316
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/iii-hq/presentation/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All coding & review skills →iii-hq/iii
Use when working with iii SDK APIs across Node.js, browser, Python, Rust, or Go: package installation, worker initialization, function/trigger registration, observers, invocation, local dispatch, channels, logging,…
iii-hq/iii
Install the iii engine, set up your first worker, and get a working backend running. Use when a user wants to start a new iii project, install the SDK, or needs help with initial setup and configuration.
iii-hq/iii
Handle iii engine and SDK errors across Node, Python, Rust, and browser workers. Use when interpreting error codes, retryability, RBAC denial, timeouts, handler failures, or SDK-specific exception surfaces.
iii-hq/iii
Configure a managed iii engine through worker-compose.yaml or a directly supervised engine through config.yaml. Use for engine ports, RBAC via the rbac-proxy worker, observer limits, streams, sandboxes, and…
iii-hq/iii
Use when composing iii primitives into backend architectures: durable workflows, reactive backends, observer side effects, agentic pipelines, event-driven CQRS, effect pipelines, and trigger-transform-action automation.
iii-hq/iii
Use when registering iii functions, binding triggers, observing functions, selecting sync/void/enqueue invocation, creating workers, inspecting the live worker registry, installing registry workers, authoring event…
Add this badge to your README
[](https://modelsatlas.com/skills/iii-hq/presentation/)
<a href="https://modelsatlas.com/skills/iii-hq/presentation/"><img src="https://modelsatlas.com/skills/iii-hq/presentation/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about presentation
What does the presentation skill do?
Is presentation safe to install?
What can presentation access on my machine?
Which assistants does presentation work with?
How current is this page?
Sources
- github.com/iii-hq/iii/tree/main/skills/presentation — the audited source at commit 5c5284905316 and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the presentation skill do?
- Is presentation safe to install?
- What can presentation access on my machine?