Agent skill · Audited from source

frontend-dev-guidelines

skill · mrgoonie/claudekit-skillsLicence not declaredAudited 29 Oct 2026 · source d655ab03f566

★ 2,230pushed 208 days agoversion 2.0.0
✕BLOCKGrade F · 27/100 · 25 findings · d655ab0
2,230repo stars · whole mrgoonie/claudekit-skills

Is it safe? No — BLOCK, grade F (27/100). We read this skill's source at commit d655ab03f566 and observed filesystem, network and shell access and a hard-coded secret (see the findings). The audit raised 25 findings, 6 critical or high. What it does: Create aesthetically beautiful interfaces following proven design principles. Use when building UI/UX, analyzing designs from inspiration sites, generating design images with ai-multimodal, implementing visual hierarchy…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “frontend-dev-guidelines (mrgoonie/claudekit-skills)”. Retrieved 29 Oct 2026. https://modelsatlas.com/skills/mrgoonie/frontend-dev-guidelines

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 6 critical or high findings, starting with “Prompt injection” in .claude/skills/better-auth/SKILL.md:3. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 29 Oct 2026

Trust score27/100✕BLOCK F
1 critical5 high13 medium22 low9 info

BLOCK means the audit found something that could harm you or your machine. Grade F is shared by 105 of 14,816 audited skills.

What the source does

  • FilesystemDeclared5 observations
  • NetworkDeclared4 observations
  • ShellDeclared3 observations
  • DependenciesNot pinnedSome versions float
  • SecretsFoundSee the findings; values are never shown

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN10
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL12
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL3
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: critical finding, no behavioural pass, undeclared transfer.

Findings (25)

CRITICALPrompt injectionprompt.transfer_instruction · .claude/skills/better-auth/SKILL.md:3
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
description: Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, O
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
HIGHCode injectioncode.eval_exec · .claude/skills/ai-multimodal/scripts/media_optimizer.py:107
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
info['fps'] = eval(stream.get('r_frame_rate', '0/1'))
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · .claude/skills/chrome-devtools/scripts/evaluate.js:32
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return eval(script);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · .claude/skills/chrome-devtools/scripts/lib/selector.js:203
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
await page.$eval(parsed.selector, el => el.value = '');
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHPrompt injectionprompt.tool_poisoning · .claude/skills/context-engineering/references/context-fundamentals.md:26
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<INSTRUCTIONS>Step-by-step procedures</INSTRUCTIONS>
Why
a tool description carrying instructions to the agent
Fix
tool descriptions describe the tool; nothing else
HIGHPrompt injectionprompt.zero_width · MCP_MANAGEMENT.md:29
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
So I transferred that MCP processing part to... `gemini-cli` 😂
Why
invisible characters in instruction text
Fix
strip non-printing characters
MEDIUMInventory / provenanceinv.binary · .claude/skills/better-auth/scripts/.coverage
F-13 Inventory / provenanceCWE-1104Layer L0
.coverage
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · .claude/skills/databases/scripts/.coverage
F-13 Inventory / provenanceCWE-1104Layer L0
.coverage
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInformation disclosuredisclose.log_secret · .claude/skills/common/api_key_helper.py:293
F-12 Information disclosureCWE-209 · CWE-532Layer L1
print(f"…" + "*" * (len(api_key) - 8))
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · .claude/skills/ai-multimodal/.env.example:25
F-04 Network egressCWE-200 · CWE-319Layer L1
# GEMINI_BASE_URL=http://127.0.0.1:8045
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.db_uri · .claude/skills/backend-development/references/backend-devops.md:123
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
- DATA…://…@db:5432/myapp
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · .claude/skills/better-auth/references/email-password-auth.md:132
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
token: "…"
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · .claude/skills/better-auth/references/email-password-auth.md:166
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
token: "…",
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · .claude/skills/better-auth/references/email-password-auth.md:167
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
password: "…"
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.binary · .claude/skills/ai-multimodal/scripts/tests/.coverage
F-13 Inventory / provenanceCWE-1104Layer L0
.coverage
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWInventory / provenanceinv.binary · .claude/skills/better-auth/scripts/tests/.coverage
F-13 Inventory / provenanceCWE-1104Layer L0
.coverage
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWInventory / provenanceinv.binary · .claude/skills/media-processing/scripts/tests/.coverage
F-13 Inventory / provenanceCWE-1104Layer L0
.coverage
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWCode injectioncode.eval_exec · .claude/skills/chrome-devtools/scripts/__tests__/selector.test.js:111
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
it('should block eval( injection', () => {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · .claude/skills/chrome-devtools/scripts/__tests__/selector.test.js:120
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
() => parseSelector('//div[Function("return 1")()]'),
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWNetwork egressnet.metadata_ip · .claude/skills/web-testing/references/vulnerability-payloads.md:69
F-04 Network egressCWE-200 · CWE-319Layer L1
http://169.254.169.254/  # AWS metadata
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—

Audit 0.4.1 · source sha d655ab03f566 · 29 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishermrgoonie GitHub userOwner of the repository this skill is read from
  • Source foldermrgoonie/claudekit-skillsThe exact folder we audited
  • LicenceNot declaredAs the repository states it
  • Commit pinned for this verdictd655ab03f566A new audit runs when the source changes
  • Repository statusNot archivedLast push 208 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Create aesthetically beautiful interfaces following proven design principles. Use when building UI/UX, analyzing designs from inspiration sites, generating design images with ai-multimodal, implementing visual hierarchy…

---
name: aesthetic
description: Create aesthetically beautiful interfaces following proven design principles. Use when building UI/UX, analyzing designs from inspiration sites, generating design images with ai-multimodal, implementing visual hierarchy and color theory, adding micro-interactions, or creating design documentation. Includes workflows for capturing and analyzing inspiration screenshots with chrome-devtools and ai-multimodal, iterative design image generation until aesthetic standards are met, and comprehensive design system guidance covering BEAUTIFUL (aesthetic principles), RIGHT (functionality/accessibility), SATISFYING (micro-interactions), and PEAK (storytelling) stages. Integrates with chrome-devtools, ai-multimodal, media-processing, ui-styling, and web-frameworks skills.
---

# Aesthetic

Create aesthetically beautiful interfaces by following proven design principles and systematic workflows.

## When to Use This Skill

Use when:
- Building or designing user interfaces
- Analyzing designs from inspiration websites (Dribbble, Mobbin, Behance)
- Generating design images and evaluating aesthetic quality
- Implementing visual hierarchy, typography, color theory
- Adding micro-interactions and animations
- Creating design documentation and style guides
- Need guidance on accessibility and design systems

## Core Framework: Four-Stage Approach

### 1. BEAUTIFUL: Understanding Aesthetics
Study existing designs, identify patterns, extract principles. AI lacks aesthetic sense—standards must come from analyzing high-quality examples and aligning with market tastes.

**Reference**: [`references/design-principles.md`](references/design-principles.md) - Visual hierarchy, typography, color theory, white space principles.

### 2. RIGHT: Ensuring Functionality
Beautiful designs lacking usability are worthless. Study design systems, component architecture, accessibility requirements.

**Reference**: [`references/design-principles.md`](references/design-principles.md) - Design systems, component libraries, WCAG accessibility standards.

### 3. SATISFYING: Micro-Interactions
Incorporate subtle animations with appropriate timing (150-300ms), easing curves (ease-out for entry, ease-in for exit), sequential delays.

**Reference**: [`references/micro-interactions.md`](references/micro-interactions.md) - Duration guidelines, easing curves, performance optimization.

### 4. PEAK: Storytelling Through Design
Elevate with narrative elements—parallax effects, particle systems, thematic consistency. Use restraint: "too much of anything isn't good."

**Reference**: [`references/storytelling-design.md`](references/storytelling-design.md) - Narrative elements, scroll-based storytelling, interactive techniques.

## Workflows

### Workflow 1: Capture & Analyze Inspiration

**Purpose**: Extract design guidelines from inspiration websites.

**Steps**:
1. Browse inspiration sites (Dribbble, Mobbin, Behance, Awwwards)
2. Use **chrome-devtools** skill to capture full-screen screenshots (not full page)
3. Use **ai-multimodal** skill to analyze screenshots and extract:
   - Design style (Minimalism, Glassmorphism, Neo-brutalism, etc.)
   - Layout structure & grid systems
   - Typography system & hierarchy
     **IMPORTANT:** Try to predict the font name (Google Fonts) and font size in the given screenshot, don't just use Inter or Poppins.
   - Color palette with hex codes
   - Visual hierarchy techniques
   - Component patterns & styling
   - Micro-interactions
   - Accessibility considerations
   - Overall aesthetic quality rating (1-10)
4. Document findings in project design guidelines using templates

### Workflow 2: Generate & Iterate Design Images

**Purpose**: Create aesthetically pleasing design images through iteration.

**Steps**:
1. Define design prompt with: style, colors, typography, audience, animation specs
2. Use **ai-multimodal** skill to generate design images with Gemini API
3. Use **ai-multimodal** skill to analyze output images and evaluate aesthetic quality
4. If score < 7/10 or fails professional standards:
   - Identify specific weaknesses (color, typography, layout, spacing, hierarchy)
   - Refine prompt with improvements
   - Regenerate with **ai-multimodal** or use **media-processing** skill to modify outputs (resize, crop, filters, composition)
5. Repeat until aesthetic standards met (score ≥ 7/10)
6. Document final design decisions using templates

## Design Documentation

### Create Design Guidelines
Use [`assets/design-guideline-template.md`](assets/design-guideline-template.md) to document:
- Color patterns & psychology
- Typography system & hierarchy
- Layout principles & spacing
- Component styling standards
- Accessibility considerations
- Design highlights & rationale

Save in project `./docs/design-guideline.md`.

### Create Design Story
Use [`assets/design-story-template.md`](assets/design-story-template.md) to document:
- Narrative elements & themes
- Emotional journey
- User journey & peak moments
- Design decision rationale

Save in project `./docs/design-story.md`.

## Resources & Integration

### Related Skills
- **ai-multimodal**: Analyze documents, screenshots & videos, generate design images, edit generated images, evaluate aesthetic quality using Gemini API
- **chrome-devtools**: Capture full-screen screenshots from inspiration websites, navigate between pages, interact with elements, read console logs & network requests
- **media-processing**: Refine generated images (FFmpeg for video, ImageMagick for images)
- **ui-styling**: Implement designs with shadcn/ui components + Tailwind CSS utility-first styling
- **web-frameworks**: Build with Next.js (App Router, Server Components, SSR/SSG)

### Reference Documentation
**References**: [`references/design-resources.md`](references/design-resources.md) - Inspiration platforms, design systems, AI tools, MCP integrations, development strategies.

## Key Principles

1. Aesthetic standards come from humans, not AI—study 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit d655ab0

pip install google-genai python-dotenv pillow
pip install httpie
npm install -g 0x
npm install -g clinic
npm install better-auth
npm install drizzle-orm better-auth

Commands as the repository documents them: shown, never run by us. Our verdict covers commit d655ab03f566 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
Claude DesktopMentioned in its text, not testedSkills for Claude Desktop · About Claude Desktop
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
Gemini CLIMentioned in its text, not testedSkills for Gemini CLI · About Gemini CLI
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
WindsurfMentioned in its text, not testedSkills for Windsurf · About Windsurf
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK F 27 / 100

    first audit · source d655ab03f566

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F
[![ModelsAtlas: BLOCK F](https://modelsatlas.com/skills/mrgoonie/frontend-dev-guidelines/badge.svg)](https://modelsatlas.com/skills/mrgoonie/frontend-dev-guidelines/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Add this badge to your README

[![ModelsAtlas: BLOCK F](https://modelsatlas.com/skills/mrgoonie/frontend-dev-guidelines/badge.svg)](https://modelsatlas.com/skills/mrgoonie/frontend-dev-guidelines/)

Questions about frontend-dev-guidelines

What does the frontend-dev-guidelines skill do?
All powerful skills of ClaudeKit.cc!
Is frontend-dev-guidelines safe to install?
No — not without reading the findings first. The audit graded it F (27/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can frontend-dev-guidelines access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does frontend-dev-guidelines work with?
Its documentation mentions claude-code, claude-desktop, cursor, gemini-cli, openclaw and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (d655ab03f566), read on 2026-10-29. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.