Agent skill · Audited from source
design-taste-frontend-v1
skill · leonxlnx/taste-skillMIT licenceAudited 31 Oct 2026 · source 2ad1e37824ba
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 2ad1e37824ba and observed network and shell access and no hard-coded secrets. The audit raised 5 findings, 1 critical or high. What it does: tasteskill v2, the anti-slop frontend skill. Art direction for websites, distilled from a study of 247 curated gallery sites (One Page Love, Awwwards Sites of the Day). Deals researched directions (idea, composition,…
Cite
Cite this page
ModelsAtlas. “design-taste-frontend-v1 (leonxlnx/taste-skill)”. Retrieved 31 Oct 2026. https://modelsatlas.com/skills/leonxlnx/design-taste-frontend-v1
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in skills/taste-skill/SKILL.md:42. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 31 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 721 of 17,602 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkDeclared8 observations
- ShellDeclared1 observation
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 2 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 3 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (5)
HIGHPrompt injectionprompt.credential_read · skills/taste-skill/SKILL.md:42
or Chromium, and install nothing. `assets.mjs` also needs network access; it uses no API keys.
- Why
- asks the agent to read credentials
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · skills/taste-skill/scripts/inspect.mjs:63
url = `http://127.0.0.1:${server.address().port}/${relative(root, file).split(sep).map(encodeURIComponent).join('/')}`;- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · skills/taste-skill/scripts/scenes.mjs:45
url = `http://127.0.0.1:${server.address().port}/${relative(root, file).split(sep).map(encodeURIComponent).join('/')}`;- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.credential_read · CHANGELOG.md:146
Node 22+ and an installed Chrome, Edge or Chromium for the inspector (nothing is installed; it drives the browser over the DevTools protocol). `draw.mjs`, `lint.mjs` and `assets.mjs` run on Node 18+;
- Why
- asks the agent to read credentials
- Fix
- —
INFOPrompt injectionprompt.credential_read · skills/taste-skill/README.md:57
`lint.mjs` and `assets.mjs` run on Node 18+; `assets.mjs` needs network access and no API keys. Set
- Why
- asks the agent to read credentials
- Fix
- —
Audit 0.4.1 · source sha 2ad1e37824ba · 31 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherleonxlnx GitHub userOwner of the repository this skill is read from
- Source folderleonxlnx/taste-skillThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict2ad1e37824baA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: tasteskill v2, the anti-slop frontend skill. Art direction for websites, distilled from a study of 247 curated gallery sites (One Page Love, Awwwards Sites of the Day). Deals researched directions (idea, composition,…
--- name: design-taste-frontend description: >- tasteskill v2, the anti-slop frontend skill. Art direction for websites, distilled from a study of 247 curated gallery sites (One Page Love, Awwwards Sites of the Day). Deals researched directions (idea, composition, type, palette, photographs, section blueprints) from a library, enforces a strict no-slop house style with a real-browser inspector, and runs a look-and-fix loop on screenshots. Use this whenever you build, design, redesign, restyle, polish or review a landing page, marketing site, portfolio, product page, one-pager, hero or any public-facing web page, in any stack (HTML/CSS, React, Next.js, Vue, Svelte, Astro, Tailwind) — also when the user says a page looks generic, templated, "AI-made", sloppy, or asks to make it look designed, premium, award-level or less like every other site. Also for app screens: dashboards, admin and analytics views, settings, inboxes and other screens people work in, with their own run and rules. --- # tasteskill v2 A page built by a model usually looks like the average of every page the model has seen: a centred headline over three lines, a little label above it, a row of icon cards, a soft gradient, a few thin rules and a monospace caption. Nothing in it is wrong and nothing in it was decided. This skill replaces those defaults with decisions, in four ways: 1. **A script deals the directions, you choose among them.** Asked to invent a look, a model picks the category default every time. `scripts/draw.mjs` deals three of twenty researched directions; you choose the one that carries the subject's idea, and the script then deals its type system, palette, hero and section compositions from a library distilled from 247 real sites. 2. **The idea comes from the subject.** In the study, what separated the best sites from the forgettable ones was a concept taken from the thing itself, not the styling. 3. **A house style with no ornaments,** measured in a real browser by `scripts/inspect.mjs`, so the rules are checked rather than hoped for. 4. **You look at what you made.** Screenshots at three widths, a juror's rubric, fix, look again. One warning learned in testing. Taking the ornaments away is only half the job; a page that has lost its labels, rules and cards and gained nothing in their place reads as thin, and blind jurors rightly prefer a richer page with tells over an empty page without them. The other half is substance: type set larger, whole fields of colour, real pictures of this subject's world (found or drawn), and every section carrying its full content. The skill is built to give you that; do not trade it for restraint. In the commands below `<skill>` is this skill's folder. Run them from the project's root, so the working files land in `.taste-skill/` there. The scripts need Node 22+ and an installed Chrome, Edge or Chromium, and install nothing. `assets.mjs` also needs network access; it uses no API keys. ## Page or app screen Decide first which of two kinds of work this is. - **A page** is read and scrolled: a landing page, a marketing or product site, a portfolio, an event, a restaurant, a one-pager. It follows **the run** below. - **An app screen** is worked in: a dashboard, an admin or analytics view, settings, billing, an inbox or queue to work through, a wallet, a list with filters, an editor or builder. It follows **`references/app-screens.md`**: its own run, its own draw (`draw.mjs --app`), its own house rules (quiet borders, small labels and repeated panels are normal there; gradients, glows, icons in tinted squares, rainbow charts and invented vanity numbers are not) and `inspect.mjs --app`. Read that file whole before you start; the page run below does not apply. A product site that shows its app is a page; the interface fragments on it follow the app-screen rules for their insides. Deal the product's app style once, in its own folder, with the page's colours and type kept: ```bash node <skill>/scripts/draw.mjs --app --kind <kind> --brief "<the product>" --keep palette,type --out .taste-skill/app ``` and build every fragment the page shows (the hero's live screen, a feature's crop, a chart) as a real piece of that app: `assets/app.css` for its panels, tables and controls, `assets/charts.js` for its charts, real data that adds up, one finding stated, cropped and scaled the way the page's blueprint treats a picture. A fragment that looks like a working product is the strongest picture a software page has; grey bars and lorem numbers are the weakest. When a request mixes both (a landing page and the dashboard behind it), build each with its own run and one shared palette and typeface. ## The run Do these in order. Steps 1–5 take a few minutes and decide whether the page is any good. ### 1. Read the brief and the project Find out what is real: the subject, the audience, the one thing the page must get someone to do, the stack, any existing brand (colours, fonts, logo), and above all **what imagery truly exists**: the project's own photographs or product shots, a real interface that can be shown, an image generation tool you can call, or nothing. Do not plan around pictures you do not have. Nothing of its own is rarely nothing at all: the subject's city, street, materials and history are in open archives and museums, free to use with a credit (step 6, `scripts/assets.mjs`). If the request is vague, decide and state your reading in one line instead of asking. Ask only when a missing fact blocks the work (for example, no product name). Then **inventory the subject** in your notes: eight to twelve things that belong to this client and to no competitor. Look for its name and what the name means; its address, door number, street and neighbourhood, and what that place looks like (its tiles, signs, paint colours, typefaces on its shop fronts, its light, its weather); the numbers in the brief (seats, rooms, minutes to the sea, the p
Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 2ad1e37
npx skills add https://github.com/Leonxlnx/taste-skill --skill "design-taste-frontend-v1" npx skills add https://github.com/Leonxlnx/taste-skill --skill "design-taste-frontend" npx skills add https://github.com/Leonxlnx/taste-skill-classics --skill "high-end-visual-design"
git clone https://github.com/leonxlnx/taste-skill git -C taste-skill checkout 2ad1e37824ba
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 2ad1e37824ba only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
2ad1e37824ba
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/leonxlnx/design-taste-frontend-v1/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All design & front-end skills →wzj1228516103/NoShitUi-skill
Discover, compare, and integrate open-source UI libraries, components, templates, and design references into web interfaces. Use when a user asks for UI inspiration, a reusable component strategy, a UI stack comparison,…
mrgediao/shuorenhua
按用户要求审稿或去 AI 味,支持中英文;保留事实、术语与责任主体,支持只标问题。
facebook/react
Use when you want to validate changes before committing, or when you need to check all React contribution requirements.
facebook/react
Use when you need to run tests for React core. Supports source, www, stable, and experimental channels.
facebook/react
Use when you need to run Flow type checking, or when seeing Flow type errors in React code.
facebook/react
Use when you need to check feature flag states, compare channels, or debug why a feature behaves differently across release channels.
Add this badge to your README
[](https://modelsatlas.com/skills/leonxlnx/design-taste-frontend-v1/)
<a href="https://modelsatlas.com/skills/leonxlnx/design-taste-frontend-v1/"><img src="https://modelsatlas.com/skills/leonxlnx/design-taste-frontend-v1/badge.svg" alt="ModelsAtlas: BLOCK D"></a>
Questions about design-taste-frontend-v1
What does the design-taste-frontend-v1 skill do?
Is design-taste-frontend-v1 safe to install?
What can design-taste-frontend-v1 access on my machine?
Which assistants does design-taste-frontend-v1 work with?
How current is this page?
Sources
- github.com/leonxlnx/taste-skill — the audited source at commit 2ad1e37824ba and every finding aboveObserved · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the design-taste-frontend-v1 skill do?
- Is design-taste-frontend-v1 safe to install?
- What can design-taste-frontend-v1 access on my machine?