Atlas / Skills / pbakaus / Skill

SkillBLOCK

skills/pbakaus/skill

The design language that makes your AI harness better at design.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
4 documented
License
Apache-2.0
Stars
72,656
01

Overview

The design language that makes your AI harness better at design.

Read from source at commit 7f79c026869fOBSERVED · 2026-09-30
02

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
codexmentioned
copilotmentioned
cursormentioned
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
UNDECLARED (5 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (12)

HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
reference/critique.md:255
This is fire-and-forget. Do not show the user the helper's JSON output; only the human-readable trend line and the written path. Failures here should not block the rest of the flow; print the error an
Why it matters. asks the agent to act without the user's knowledge
MEDIUMNetwork egress · net.client · CWE-200, CWE-319
scripts/live-browser.js:3808
const res = await fetch('http://localhost:' + PORT + '/manual-edit-stash?token=' + encodeURIComponent(TOKEN), {
MEDIUMNetwork egress · net.client · CWE-200, CWE-319
scripts/live-browser.js:4124
const res = await fetch(
MEDIUMNetwork egress · net.client · CWE-200, CWE-319
scripts/live-browser.js:4144
const res = await fetch(
MEDIUMNetwork egress · net.client · CWE-200, CWE-319
scripts/live-browser.js:4188
const res = await fetch(
MEDIUMNetwork egress · net.client · CWE-200, CWE-319
scripts/live-browser.js:4237
const res = await fetch(
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
reference/live.md:195
<div data-impeccable-variant="2" style="display: none">
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
reference/live.md:198
<div data-impeccable-variant="3" style="display: none">
MEDIUMPrompt injection · scope.undeclared_network · CWE-94, CWE-1427
<declared scope>
network use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare network use in the description, or remove it
MEDIUMInventory / provenance · skill.no_skill_md · CWE-1104
Why it matters. no SKILL.md at the audited path
Fix. a skill without its instruction file cannot be reviewed as one
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
reference/generate.md:49
{{scripts_path}}/impeccable live-generate --target src/App.jsx --dev-url http://127.0.0.1:5173/ --selector ".pricing-grid" --action bolder --count 3 --boot --wait-for-browser 60000
INFOInventory / provenance · inv.oversize · CWE-1104
scripts/data/font-index.json
scripts/data/font-index.json
Why it matters. 1100013 bytes not read

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-09-30 · audit v0.4.1 · source sha 7f79c026869ffull audit observations/trust-audit/skill/pbakaus__skill.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-09-307f79c026869fBLOCKD69first audit
05

Questions

What does the Skill skill do?

The design language that makes your AI harness better at design.

Is Skill safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can Skill access on my machine?

The audit observed that it reaches the network. At least one of those is not mentioned in its own description, which is itself a finding. Secrets in the source: none found.

Which assistants does Skill work with?

Its documentation mentions claude-code, codex, copilot and cursor. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (7f79c026869f), read on 2026-09-30. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement