Agent skill · Audited from source

imprint

skill · javascript-mastery-pro/skillsMIT licenceAudited 26 Oct 2026 · source 60318dc84d13

★ 1,553pushed 77 days ago
✓SAFEGrade B · 89/100 · 26 Oct 2026 · 60318dc
1,553repo stars · whole javascript-mastery-pro/skills

Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 60318dc84d13 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Run /architect when choosing between approaches, designing a feature or page, picking a tech stack, or when /develop says a decision is owed, anytime a load bearing technical decision is unmade. Asks deep questions,…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “imprint (javascript-mastery-pro/skills)”. Retrieved 26 Oct 2026. https://modelsatlas.com/skills/javascript-mastery-pro/imprint

Trust audit

Audit 0.4.1 · source read 26 Oct 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium0 low7 info

SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS0
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS7
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (7)

INFOPrompt injectionprompt.authority_framing · skills/develop/ui-guide.md:7
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
You are a senior product designer shipping a real product, not a developer wiring a form. Every UI page must leave as a complete, professional product surface, the quality you would expect from a top
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/develop/ui/generate.md:93
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
You are a senior product designer. Every page ships as a complete, professional product surface: brand, real product specific copy, a considered layout with hierarchy, all states (empty, loading, erro
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/develop/ui/implementation.md:64
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Pass 1 from the guide's bar: design before you integrate. A gate, not advice, on every screen (auth, dashboard, feed, pricing, profile, detail, list/search, onboarding, settings, checkout, empty state
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/scope/approaches/journey.md:3
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Adopt this role for decomposition. You are a senior engineer whose instinct is: **deliver one complete user journey, fully, before starting the next.** The experience and the funnel are the product. Y
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · skills/scope/approaches/skateboard.md:3
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Adopt this role for decomposition. You are a senior product engineer whose instinct is: **ship the smallest complete product a real person would actually use, then grow it.** Not a thin thread to prov
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.credential_read · skills/develop/logical-guide.md:54
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Read secrets/keys from environment variables or a secrets manager, **never hardcode credentials** or commit them. Name each new env var; note it for the engineer.
Why
asks the agent to read credentials
Fix
—
INFOPrompt injectionprompt.credential_read · skills/test/writing-guide.md:27
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
If any file in scope handles authentication, authorization, sessions, payments, or PII (signals: `auth`, `login`, `session`, `token`, `password`, `permission`, `role`, `payment`, `charge`, `webhook`,
Why
asks the agent to read credentials
Fix
—

Audit 0.4.1 · source sha 60318dc84d13 · 26 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherjavascript-mastery-pro GitHub organizationOwner of the repository this skill is read from
  • Source folderjavascript-mastery-pro/skillsThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict60318dc84d13A new audit runs when the source changes
  • Repository statusNot archivedLast push 77 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Run /architect when choosing between approaches, designing a feature or page, picking a tech stack, or when /develop says a decision is owed, anytime a load bearing technical decision is unmade. Asks deep questions,…

---
name: architect
allowed-tools: Bash, Read, Grep, Glob, Write, Edit, Agent, AskUserQuestion
description: "Run /architect when choosing between approaches, designing a feature or page, picking a tech stack, or when /develop says a decision is owed, anytime a load bearing technical decision is unmade. Asks deep questions, recommends an answer, and writes a build spec to docs/specs/. Owns all spec files."
---

## Output style (plain words, no dashes, no hyphens)

<!-- OUTPUT-STYLE:START -->
Write everything this skill produces, files and messages alike, in plain simple language. Talk to the reader as `you`, warm and direct like a colleague, and present every step as a recommendation they may run or skip, never an order. Keep technical terms that carry real meaning; explain each in plain words. Never use a dash or a hyphen as punctuation: no em dash, no en dash, and no hyphenated compounds. Write `read only`, not `read-only`. Say it in simple words, or reword the sentence. Code, file paths, command flags, and values other skills match on keep their hyphens. Use short sentences, commas, or parentheses. Clear beats clever.
<!-- OUTPUT-STYLE:END -->

## What this skill does

Runs structured discovery, weighs options, and writes or updates a build spec in `docs/specs/`. The main thread writes; it offloads only reading the codebase or fetching the web to a cheap subagent (see *Subagents*). Four modes:

| Mode | When | Design behaviour |
|---|---|---|
| `FEATURE` | Designing a new feature from scratch, with or without existing code | First principles design, best practices, minimal code reading |
| `ARCHITECTURE` | Choosing a tech stack or foundational architecture for a new project | Comprehensive stack evaluation, industry patterns, no code to read |
| `ENHANCEMENT` | Improving, replacing, or scaling something that already exists | Read existing code + specs, focused option comparison |
| `CROSS-CUTTING` | Standardising a pattern across the whole codebase (error handling, logging, auth, naming) | Sample current state, define the standard precisely, recommend enforcement |

- **Create**: new decision → new spec with status `Proposed`
- **Update**: evolving an existing decision → edit existing spec in place
- **Supersede**: replacing a past decision → new spec + update old spec's status line
- **Ratify**: deliberating an `Assumed` spec that `/develop` recorded when the engineer chose to build before deciding → see *Ratify an assumed decision* below

Spec status behaves one of two ways, decided by whether a buildable scope feature links the spec (a `docs/scope/` row whose `spec` cell points to it):

- **Feature linked spec** (typical FEATURE/ENHANCEMENT, or an ARCHITECTURE foundation that has a scope row): status mirrors the feature lifecycle. /architect creates it as `Proposed` and owns its content but never advances the status; /develop advances it to `In Progress` when the feature goes in-progress, then `Accepted` when built and verified (scope `done`). Engineer confirmation ratifies content only; `Accepted` means shipped.
- **Standalone decision spec** (foundational/stack or cross cutting standard, no scope row links it): decision status. `Proposed` when written, `Accepted` once the engineer ratifies it on confirmation (the decision is then in force). /develop does not advance it.

A spec documenting already shipped work (the "already built" path, or a linked feature already `existing`) is born `Accepted`.

**The `Assumed` status.** `/develop` may create a spec in status `Assumed` when the engineer chooses to build before a load bearing decision is deliberated. It records the assumption the build used, not a deliberated decision. The feature can still be marked `done`; the `Assumed` spec stays flagged as owing ratification and does not block it. Only `/architect` clears the `Assumed` status, by ratifying (below). `/architect` never creates an `Assumed` spec; it only deliberates one that already exists.

Writes no code. Never updates `AGENTS.md`/`CLAUDE.md` (/sync owns that).

## Subagents (main thread writes; subagents only read, fetch, or cross check)

The main thread runs the conversation and writes the spec; it never hands the writing or any fix to a subagent. Every subagent it spawns is read only and never inherits the session model:

- **Read the codebase** (cheapest model, Claude Code `haiku`): a read only scan of existing code when the repo is large (ENHANCEMENT/CROSS-CUTTING). Claude Code: the `scout` type. Returns a compact map, never file dumps.
- **Fetch from the web** (cheapest model, Claude Code `haiku`): the current tool landscape check and the Agent Skill / MCP discovery, both during the design conversation (Stage c), when a decision needs current facts. Claude Code: the `researcher` type. Returns a compact summary, never raw pages.
- **Cross check the drafted spec** (its primary job is decision completeness: finding values an action must produce whose source the spec never names, and decisions the builder would otherwise invent): a read only pass that reads the finished spec and returns a critique, writing nothing. `/architect` **always asks** whether to run it (never runs or skips it on the engineer's behalf), recommending `Another model` strongly at `GA`/`Beta` (the tiers where these bugs live), offering it at `Alpha`, and recommending `Skip` at `Prototype`; any gap it finds is presented to the engineer with a recommended fix for them to decide, not auto resolved. See *After the spec is written*.

Web fetching happens once, when a decision needs it (the Stage (c) landscape and tool discovery checks). The links it returns go into the spec's References for a human to follow; the AI never fetches them again (not in the cross check, `/develop`, or `/audit`).

## Asks vs acts

Ask targeted questions before you write the spec (and before spawning any read/fetch helper); spend the budget on substance. Sort every question:

- **INFER**: anything the prompt or codebase reveals (feat

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 60318dc

Download folder ↗
pip install pytest pytest-mock                                    # Python

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 60318dc84d13 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✓SAFE B 89 / 100

    first audit · source 60318dc84d13

README badge

For maintainers · shows the latest audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B
[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/javascript-mastery-pro/imprint/badge.svg)](https://modelsatlas.com/skills/javascript-mastery-pro/imprint/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

sync✓SAFE

javascript-mastery-pro/skills

Run /sync as the last step after a change is complete, around merge, to keep durable knowledge current. Updates root and nested AGENTS.md, reconciles the scope from repo evidence, and flags specs the change made stale.…

★ 1.6kGrade B
test!CAUTION

javascript-mastery-pro/skills

Run /test to write a test suite for code you just built or changed, after implementing a feature, route, or fix. Targets uncommitted changes automatically, reads test preferences.json for your framework (asks and saves…

★ 1.6kGrade B
scope✓SAFE

javascript-mastery-pro/skills

Run /scope to turn a product idea into a living, coarse scope in docs/scope/ and keep it current: plan a new product, plan the next slice, enroll one named feature, or run with no argument to reconcile after shipping…

★ 1.6kGrade B
document✓SAFE

javascript-mastery-pro/skills

Run /document `pr` | `changelog` | `release-note` | `postmortem` (or let it ask) to write the human facing prose about a change. Drafts from the real commits and diff, writing to the right place. Does not write code,…

★ 1.5kGrade B
develop✓SAFE

javascript-mastery-pro/skills

Run /develop to build a feature, UI or backend, from an approved design, a page, component, API, service, or data slice. If something load bearing is undecided and no spec records it, it stops and routes you to…

★ 1.5kGrade B
debug✓SAFE

javascript-mastery-pro/skills

Run /debug to find and fix a bug's root cause: a test failing for an unclear reason, /check verify finding a failure, or behavior being wrong. Runs a reproduce, localize, hypothesize, test, fix, verify loop, makes the…

★ 1.5kGrade B

Add this badge to your README

[![ModelsAtlas: SAFE B](https://modelsatlas.com/skills/javascript-mastery-pro/imprint/badge.svg)](https://modelsatlas.com/skills/javascript-mastery-pro/imprint/)

Questions about imprint

What does the imprint skill do?
Agentic Development skills behind the JS Mastery workflow
Is imprint safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can imprint access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does imprint work with?
Its documentation mentions claude-code, codex, cursor and gemini-cli. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (60318dc84d13), read on 2026-10-26. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.