Skip to content
skillsafebeta
← Report library
Purpose / Development

Design Mobile Apps Skill Security Audit

What the author says it does (original text)

Use when the user wants to design a mobile app or UI screens, when they mention their Sleek (sleek.design) projects, or when implementing Sleek designs in code (HTML, React Native, SwiftUI).

Independent security check

Do not install or run it yet

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Downloaded complete HTML may execute external or untrusted scripts when opened

Source references: 3
What we found

The Skill directs the agent to save the service-returned complete HTML unchanged and states that default HTML loads an Iconify script. The content is generated by an external AI service, yet the instructions do not require inspection, sanitization, or isolation before opening or integration.

Why this matters

When a prototype is opened, scripts or remote resources in the HTML could run with browser privileges, make network requests, track access, or read same-origin-accessible data. The risk depends on the returned HTML; the evidence does not show that malicious code is actually present.

This is a plausible conditional risk. The Skill retrieves externally AI-generated component code and saves the complete HTML unchanged; it also states that the default HTML loads the Iconify script. If the user later opens that file in a browser, scripts can run in the page context and make third-party requests. No review, sanitization, or isolation requirement is visible. Users can require previews to run in an unprivileged sandbox and disable or inspect remote scripts before opening them.

SKILL.md:162In the instructionsOpen original file
### HTML prototypesThe component `code` is a complete HTML document. Save it directly to a `.html` file. No build step needed.
Show 2 other places
SKILL.md:280In the instructionsOpen original file
Both list and get accept an optional `inlineIcons` query param (default `false`). When omitted, icons render as `<iconify-icon>` web components and the HTML pulls in the Iconify script, so leave it off by default. Pass `?inlineIcons=true` only when the consumer needs self-contained SVGs in the HTML (for example, importing into tools that don't run scripts).
SKILL.md:118In the instructionsOpen original file
When the user wants to implement the designs in code (not just preview them), **always fetch the component HTML code**. Do not rely on screenshots alone.Use `GET /api/v1/projects/:id/components/:componentId` to fetch each screen's code. The `componentId` comes from the chat run's `result.operations`.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Fallback sign-in asks the user to paste the full API key into the agent

Source references: 3
What we found

When device authorization is unavailable, the Skill explicitly asks the user to paste back a full key whose value is displayed only once. This can place the credential in chat history, model context, logs, or session exports instead of keeping it solely in secret storage.

Why this matters

Anyone obtaining the key could act within its scopes—potentially reading projects, creating or deleting projects, sending design messages, or rendering screenshots—until it expires or is revoked.

The risk is directly supported. If the environment variable is absent and the fallback is used, the Skill asks the user to paste the complete key into the conversation; the key is shown only once at creation. It could therefore enter model context, chat history, or logs. The preferred device flow stores the returned key without user handling. Users can ask the author to remove the paste-based fallback and permit only device authorization or protected secret storage.

SKILL.md:35In the instructionsOpen original file
Fallback: send the user to **https://sleek.design/agents/setup**, which handles sign-in, plan upgrade, and key creation in one place, and ask them to paste the key back to you. Keys can also be managed at **https://sleek.design/dashboard/api-keys**. The full key value is shown only once at creation.
Show 2 other places
SKILL.md:43In the instructionsOpen original file
| ----------------- | ---------------------------- || `projects:read`   | List / get projects          || `projects:write`  | Create / delete projects     || `components:read` | List components in a project || `chats:read`      | Get chat run status          || `chats:write`     | Send chat messages           || `screenshots`     | Render component screenshots |
SKILL.md:29In the instructionsOpen original file
If `SLEEK_API_KEY` is not set, use the device flow so the user never handles the raw key:1. `POST https://sleek.design/api/v1/device/start` (no auth) with body `{"source": "your-tool-slug"}`. The response contains a `verificationUrl`, a human-checkable `userCode`, a secret `deviceCode`, and a poll `interval` in seconds.2. Show the user the `verificationUrl` and the `userCode`, and tell them to confirm the code matches before approving.3. Poll `POST https://sleek.design/api/v1/device/poll` with `{"deviceCode": "..."}` every `interval` seconds. When the user approves, the poll returns `{"status": "approved", "key": "sk_..."}` exactly once: store it as `SLEEK_API_KEY`. Codes expire after 15 minutes; on `expired`, start over.
Medium risk

Design requirements and reference images are sent to the external Sleek service

Source references: 4
What we found

The core workflow submits the user's full design intent to Sleek. If `imageUrls` are included, Sleek's servers fetch those addresses. Design descriptions, product details, and image content therefore leave the local environment.

Why this matters

Unreleased product plans, customer material, internal interfaces, or personal information in images may be processed by a third party. Image URLs containing query tokens or temporary signatures may also disclose access credentials.

The core operation explicitly sends the user's full design intent to the external Sleek API, and optional image URLs are fetched by Sleek's servers. Product information in the prompt and referenced image content therefore leave the local environment. The Skill warns about sensitive image URLs but does not require a sensitivity check before sending design text. Users can limit what may be submitted and require confirmation before sending images or confidential design material.

SKILL.md:75In the instructionsOpen original file
Send the request with `POST /api/v1/projects/:id/chat/messages`. Sleek plans screen content and layout from your message, and will invent a visual style if you don't give it one. Don't decompose the request into screens and don't add product details the user didn't ask for; send the full intent as a single message. If the user described specific screens, include those. Sleek produces richer designs when given room to plan.
Show 3 other places
SKILL.md:59In the instructionsOpen original file
- **Minimal scopes**: Create API keys with only the scopes required for the task. Prefer short-lived or revocable keys.- **Image URLs**: When using `imageUrls` in chat messages, those URLs are fetched by Sleek's servers. Avoid passing URLs that contain sensitive content.
SKILL.md:359In the instructionsOpen original file
{  "message": { "text": "Add a pricing section with three tiers" },  "source": "claude-code",  "imageUrls": ["https://example.com/ref.png"],  "target": { "screenId": "scr_abc" },  "referenceId": "proj_ref1"}
SKILL.md:16In the instructionsOpen original file
[sleek.design](https://sleek.design) is an AI-powered mobile app design tool. You interact with it via a REST API at `/api/v1/*` to create projects, describe what you want built in plain language, and get back rendered screens. All communication is standard HTTP with bearer token auth.**Base URL**: `https://sleek.design`**Auth**: `Authorization: Bearer $SLEEK_API_KEY` on every `/api/v1/*` request**Content-Type**: `application/json` (requests and responses)
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The claimed “sleek.design only” network boundary conflicts with implementation instructions

Source references: 4
What we found

Metadata and security text claim requests are limited to `sleek.design`, but implementation instructions require SVG downloads from `api.iconify.design` and use Google Fonts referenced by the HTML. A strictly enforced allowlist makes those steps fail; widening access introduces undisclosed third-party connections.

Why this matters

A user may grant network permission based on an inaccurate single-host claim. If extra hosts are allowed, Iconify, font providers, and their infrastructure receive request metadata; if they are blocked, icons or fonts may be missing.

There is a clear inconsistency. The compatibility metadata and security statement limit network access to sleek.design, while implementation instructions require fetching SVGs from api.iconify.design; generated HTML may also load the Iconify script and includes Google Fonts. Enforcing the allowlist would break those features, while relaxing it permits third-party connections absent from the declared hosts. Users can ask the author to list every required domain accurately and make third-party downloads explicit and optional.

SKILL.md:4In the instructionsOpen original file
description: Use when the user wants to design a mobile app or UI screens, when they mention their Sleek (sleek.design) projects, or when implementing Sleek designs in code (HTML, React Native, SwiftUI).compatibility: Requires SLEEK_API_KEY environment variable. Network access limited to https://sleek.design only.metadata:  requires-env: SLEEK_API_KEY  allowed-hosts: https://sleek.design---
Show 3 other places
SKILL.md:56In the instructionsOpen original file
- **Single host**: All requests go exclusively to `https://sleek.design`. No data is sent to third parties.- **HTTPS only**: All communication uses HTTPS. The API key is transmitted only in the `Authorization` header to Sleek endpoints.- **Minimal scopes**: Create API keys with only the scopes required for the task. Prefer short-lived or revocable keys.
SKILL.md:184In the instructionsOpen original file
1. **Check if the project already has an icon system** that supports the same sets Sleek uses (Solar, Hugeicons, Material Symbols, MDI). If so, use it. Note: `@expo/vector-icons` does **not** support these sets, so do not use it as a substitute.2. **Otherwise, fetch the SVGs from the Iconify API and embed them in the code:**   ```   GET https://api.iconify.design/{prefix}/{name}.svg   ```   Example: `https://api.iconify.design/solar/heart-bold.svg`   Collect all icon names from the HTML, fetch their SVGs, and save them as static assets or string constants in the codebase. For **React Native / Expo**, render them with `react-native-svg`'s `SvgXml` component, which works in Expo Go with no additional native dependencies.
SKILL.md:196In the instructionsOpen original file
The HTML includes Google Fonts via `<link>` tags in the `<head>`. Use the same fonts and weights when implementing in a native framework. Extract the font family names and weights from the `<link>` tags.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill uses Sleek's REST API to create projects, submit design descriptions, and poll asynchronous generation runs, authenticated with a scoped API key.

View source
SKILL.md:16In the instructionsOpen original file
[sleek.design](https://sleek.design) is an AI-powered mobile app design tool. You interact with it via a REST API at `/api/v1/*` to create projects, describe what you want built in plain language, and get back rendered screens. All communication is standard HTTP with bearer token auth.**Base URL**: `https://sleek.design`**Auth**: `Authorization: Bearer $SLEEK_API_KEY` on every `/api/v1/*` request**Content-Type**: `application/json` (requests and responses)
SKILL.md:69In the instructionsOpen original file
Create a project with `POST /api/v1/projects` if one doesn't exist yet. Derive a name from the request.
SKILL.md:89In the instructionsOpen original file
**Polling**: chat messages are async by default: you get a `runId` and poll `GET /api/v1/projects/:id/chat/runs/:runId`. Start at 2s interval, back off to 5s after 10s, give up after 5 minutes. Exit on `completed` or `failed`; if you can't read the status, stop and report it rather than counting it as "not done yet". You can also use `?wait=true` for a blocking call (up to 300s; falls back to polling if it times out with `202`).

After screens are generated or updated, the Skill requires calling the screenshot service and persistently saving images in the user's project directory; implementation tasks also download complete component HTML.

View source
SKILL.md:99In the instructionsOpen original file
After every chat run that produces `screen_created` or `screen_updated` operations, **take screenshots and show them to the user** using `POST /api/v1/screenshots`. The step is done only when the user has seen a screenshot of every screen the run created or updated; never complete a run silently.- **New screens**: one screenshot per screen + one combined screenshot of all screens in the project.- **Updated screens**: one screenshot per affected screen.Use `background: "transparent"` unless the user explicitly requests a specific background color.Save screenshots in the project directory (not a temporary folder) so the user can easily view them.
SKILL.md:118In the instructionsOpen original file
When the user wants to implement the designs in code (not just preview them), **always fetch the component HTML code**. Do not rely on screenshots alone.Use `GET /api/v1/projects/:id/components/:componentId` to fetch each screen's code. The `componentId` comes from the chat run's `result.operations`.

The documentation discloses that sustained use after trial credits requires payment and directs the agent to state both monthly and annual pricing when relevant.

View source
SKILL.md:37In the instructionsOpen original file
**Plans**: free accounts can try the API with their one-time trial credits (about one design run), so a new user can see their first design before any payment decision. Sustained use requires the Pro plan or higher ($49.99/month, or $30/month billed yearly at $360/year; includes 20,000 monthly AI credits, roughly 650 screens). When cost becomes relevant (the user asks, an upgrade is needed to continue, or you're about to send them to a payment page), state this pricing plainly, including the yearly option. Never let a payment step come as a surprise.

The Skill recommends least-privilege, short-lived or revocable keys; available scopes include reading, creating and deleting projects, sending messages, and rendering screenshots.

View source
SKILL.md:41In the instructionsOpen original file
| Scope             | What it unlocks              || ----------------- | ---------------------------- || `projects:read`   | List / get projects          || `projects:write`  | Create / delete projects     || `components:read` | List components in a project || `chats:read`      | Get chat run status          || `chats:write`     | Send chat messages           || `screenshots`     | Render component screenshots |Create a key with only the scopes needed for the task.
SKILL.md:58In the instructionsOpen original file
- **HTTPS only**: All communication uses HTTPS. The API key is transmitted only in the `Authorization` header to Sleek endpoints.- **Minimal scopes**: Create API keys with only the scopes required for the task. Prefer short-lived or revocable keys.- **Image URLs**: When using `imageUrls` in chat messages, those URLs are fetched by Sleek's servers. Avoid passing URLs that contain sensitive content.
Start here · InstructionsSKILL.md
design-mobile-apps
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:4In the instructionsOpen original file
description: Use when the user wants to design a mobile app or UI screens, when they mention their Sleek (sleek.design) projects, or when implementing Sleek designs in code (HTML, React Native, SwiftUI).compatibility: Requires SLEEK_API_KEY environment variable. Network access limited to https://sleek.design only.metadata:
SKILL.md:7In the instructionsOpen original file
  requires-env: SLEEK_API_KEY  allowed-hosts: https://sleek.design---
SKILL.md:12In the instructionsOpen original file
[![Design mobile apps in minutes](https://raw.githubusercontent.com/sleekdotdesign/agent-skills/main/assets/hero.png)](https://sleek.design)
Read keys or account settings
SKILL.md:4In the instructionsOpen original file
description: Use when the user wants to design a mobile app or UI screens, when they mention their Sleek (sleek.design) projects, or when implementing Sleek designs in code (HTML, React Native, SwiftUI).compatibility: Requires SLEEK_API_KEY environment variable. Network access limited to https://sleek.design only.metadata:
SKILL.md:6In the instructionsOpen original file
metadata:  requires-env: SLEEK_API_KEY  allowed-hosts: https://sleek.design
SKILL.md:19In the instructionsOpen original file
**Base URL**: `https://sleek.design`**Auth**: `Authorization: Bearer $SLEEK_API_KEY` on every `/api/v1/*` request**Content-Type**: `application/json` (requests and responses)
Run commands
SKILL.md:22In the instructionsOpen original file
**CORS**: Enabled on all `/api/v1/*` endpoints**Parsing responses**: write the body to a file (`curl -o run.json`) and parse the file. Don't pipe JSON through `echo`: in zsh it expands the escaped `\n` inside string values into real newlines, which makes the body invalid JSON.**API docs**: OpenAPI spec at `https://sleek.design/api/v1/spec.json`; browsable docs at `https://sleek.design/api/v1/docs`. Fetch the spec for any contract detail not covered here.
SKILL.md:560In the instructionsOpen original file
| Assuming `result` is present on `202`                                   | `result` is absent until status is `completed`                                                       || Piping a JSON response through `echo` to parse it                       | zsh expands the `\n` in `assistantText` and breaks the JSON; parse from a file instead               || Treating an unreadable run status as "not done yet"                     | The loop then spins to its cap long after the run finished; stop and report instead                  |
Lines read
565
File checksum (to compare versions)
03ed4310b6099c43ad45bfa3ee114524af0704d121e51ac67d815990d070ba69