Skip to content
Report library
Purpose / Other

Design Taste Frontend Skill Security Audit

What the author says it does (original text)

Anti-slop frontend skill for landing pages, portfolios, and redesigns. The agent reads the brief, infers the right design direction, and ships interfaces that do not look templated. Real design systems when applicable, audit-first on redesigns, strict pre-flight check.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Recommends installing and executing unpinned third-party packages

Source references: 4
What we found

The Skill requires emitting an install command when a dependency is missing and includes `npx shadcn@latest` plus multiple npm and yarn commands. `@latest` is not version-pinned and downloads and executes whatever is current; package installation can also run third-party lifecycle scripts.

Why this matters

If the user or agent executes these commands, project dependencies and files may change. A compromised upstream package, breaking release, or mistaken package choice could execute third-party code with the permissions of the developer machine or CI job.

The Skill mandates an install command for missing dependencies and supplies `npx shadcn@latest` commands that download, execute, and write into the project. `@latest` is explicitly unpinned, and other installs are also unpinned; execution may invoke third-party lifecycle scripts. The user can require exact versions, a lockfile, and review of packages and write scope before running.

SKILL.md:156In the instructionsOpen original file
### 3.F Dependency Verification (mandatory)Before importing ANY 3rd-party library, check `package.json`. If the package is missing, output the install command first. **Never** assume a library exists.
Show 3 other places
SKILL.md:1002In the instructionsOpen original file
# Radix Themesnpm install @radix-ui/themes# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input
SKILL.md:1021In the instructionsOpen original file
# Atlassian Design System (Atlaskit)yarn add @atlaskit/css-reset @atlaskit/tokens @atlaskit/button @atlaskit/badge @atlaskit/section-message @atlaskit/card# Bootstrap 5.3npm install bootstrap
SKILL.md:1005In the instructionsOpen original file
# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Generated pages may disclose visit data to external image and script providers

Source references: 3
What we found

When image generation is unavailable, the Skill recommends embedding Picsum, Unsplash, Pexels, Simple Icons, or other brand URLs, and it suggests an external CDN script for Shopify. When browsers request these resources, providers can ordinarily receive visitor IP addresses, timing, browser details, and potentially referring-page information.

Why this matters

Production visits may be shared with third parties unexpectedly and become dependent on their availability, content changes, and privacy policies. For regulated, internal, or unreleased projects, requests may also reveal that a page or brand under development is being viewed.

The Skill recommends embedding remote Picsum, brand, and Simple Icons resources and provides a Shopify CDN script. Visitors loading them connect directly to third parties, exposing at least IP address, request time, and browser request data; referrer information may also be sent depending on policy. The user can require self-hosting, an allowlist, and CSP restrictions.

SKILL.md:268In the instructionsOpen original file
1. **Image-generation tool first.** If ANY image-gen tool is available in the environment (`generate_image`, MCP image tool, IDE-integrated gen, OpenAI image tools, etc.) you MUST use it to create section-specific assets: hero photography, product shots, texture backgrounds, mood images. Generate at the right aspect ratio for the section. Do not skip this step because hand-rolled CSS feels faster.2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:   * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)   * Actual stock or brand URLs when the brief provides them   * Open-license sources (Unsplash via direct URL, Pexels) if explicitly allowed3. **Last resort: tell the user.** If neither is possible, do NOT fill the page with hand-rolled SVG illustrations or div-based "fake screenshots." Instead, leave clearly-labeled placeholder slots (`<!-- TODO: hero product photo, 1600x1200 -->`) and at the end of the response say: *"This page needs real images at: \[list of placements\]. Please generate or provide them."*
Show 2 other places
SKILL.md:276In the instructionsOpen original file
**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos:* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.* **Alternative: devicon** for tech-stack logos (`@svgr/cli` or CDN).* **Make-up the brand name? Then make-up an SVG mark too.** Generate a simple monogram (one letter in a circle, two-letter ligature, abstract glyph) rendered as an inline `<svg>` matching the page style. Plain text wordmarks for invented brand names look generic.
SKILL.md:1027In the instructionsOpen original file
# Shopify Polaris Web Components (Shopify apps only)# Add this to your app HTML head:#   <meta name="shopify-api-key" content="%SHOPIFY_API_KEY%" />#   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>```
Medium risk

Mandatory image-generation preference may send project material to an external provider

Source references: 1
What we found

Whenever an image-generation tool is available, the Skill requires using it for section-specific product imagery, photography, and backgrounds. Useful prompts commonly contain brief, product, or brand details, but the text does not require checking the tool’s data-handling terms or excluding confidential material first.

Why this matters

If prompts or uploaded references contain an unreleased product, client identity, proprietary visuals, or confidential brief details, that material may leave the local environment and become subject to the provider’s retention, training, and access policies.

Whenever an image-generation tool exists, the Skill mandates section-specific product images, photography, and backgrounds, which normally requires placing brand, product, and visual details from the brief into prompts. It does not require checking whether the tool is external, obtaining consent, or excluding confidential material. The user can require provider, retention, and allowed-field review first.

SKILL.md:266In the instructionsOpen original file
**Priority order for visual assets:**1. **Image-generation tool first.** If ANY image-gen tool is available in the environment (`generate_image`, MCP image tool, IDE-integrated gen, OpenAI image tools, etc.) you MUST use it to create section-specific assets: hero photography, product shots, texture backgrounds, mood images. Generate at the right aspect ratio for the section. Do not skip this step because hand-rolled CSS feels faster.2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:   * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)   * Actual stock or brand URLs when the brief provides them   * Open-license sources (Unsplash via direct URL, Pexels) if explicitly allowed3. **Last resort: tell the user.** If neither is possible, do NOT fill the page with hand-rolled SVG illustrations or div-based "fake screenshots." Instead, leave clearly-labeled placeholder slots (`<!-- TODO: hero product photo, 1600x1200 -->`) and at the end of the response say: *"This page needs real images at: \[list of placements\]. Please generate or provide them."*
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 13
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This command uses `@latest`, so it fetches and runs whatever shadcn CLI is current at execution time rather than a version reviewed here. It applies only when shadcn/ui is selected. The user can require an audited exact version and lockfile.

The Material Web install command has no version pin, so resolved code can change over time and dependency install scripts may run. It is relevant only when Material is chosen. The user can require an exact version and lockfile.

The Fluent UI React command is unpinned, so a future run may install different code. The risk arises only if the user adopts this design system and runs the command; an exact version and reviewed lockfile can be required.

Neither Fluent UI package is version-pinned, so installation depends on the registry state and dependency resolution at that time. The user can restrict installation to reviewed exact versions and retain a lockfile.

The Carbon packages have no version constraints, so the same command may later resolve different code and transitive dependencies. Impact occurs only if Carbon is selected and the command is run; exact versions can be required.

The Radix Themes command is unpinned, so it does not guarantee that execution will retrieve the version contemplated by this review. The user can require pinned, reviewed versions and a lockfile.

`npx shadcn@latest init` explicitly downloads and runs the latest CLI, and initialization may modify project files. The risk occurs only on execution. The user can require a pinned CLI version, expected file changes, and a lockfile.

This `npx` command uses `@latest` and runs a CLI that writes components into the project; its behavior and output can change by version. The user can require a pinned version and review files to be added or overwritten before running it.

The Primer Brand command does not specify a version, so the package and transitive dependencies resolved at execution may change. The user can require an exact version and lockfile.

The GOV.UK Frontend command is unpinned; even though it names an official package, future releases may differ. The user can require a pinned, reviewed version.

The USWDS command has no version number, so the same command may later resolve different implementation code and dependencies. The risk is conditional on execution; the user can require version pinning.

This yarn command installs several unpinned Atlaskit packages, increasing the set of direct and transitive dependencies that may change over time. The user can require exact versions for each package and review the lockfile.

The Bootstrap command is unpinned, so a future run may install different code. It changes the project only if the user runs it; an exact version and lockfile can be required.

SKILL.md:99In the instructionsOpen original file
| Modern accessible React foundation | `@radix-ui/themes` | Primitives + polished theme || Modern SaaS where you own the components | shadcn/ui (`npx shadcn@latest add ...`) | You own the code, easy to customise; never ship default state || Tailwind-based modern SaaS / AI marketing | Tailwind v4 utilities + `dark:` variant | Default for indie + small team builds |
Show 12 other places
SKILL.md:991In the instructionsOpen original file
# Material Web (Material 3)npm install @material/web
SKILL.md:994In the instructionsOpen original file
# Fluent UI React (v9)npm install @fluentui/react-components
SKILL.md:997In the instructionsOpen original file
# Fluent UI Web Components (framework-free)npm install @fluentui/web-components @fluentui/tokens
SKILL.md:1000In the instructionsOpen original file
# IBM Carbonnpm install @carbon/react @carbon/styles
SKILL.md:1003In the instructionsOpen original file
# Radix Themesnpm install @radix-ui/themes
SKILL.md:1006In the instructionsOpen original file
# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input
SKILL.md:1007In the instructionsOpen original file
npx shadcn@latest initnpx shadcn@latest add button card badge separator input
SKILL.md:1013In the instructionsOpen original file
# Primer Brand (GitHub marketing UI)npm install @primer/react-brand
SKILL.md:1016In the instructionsOpen original file
# GOV.UK Frontendnpm install govuk-frontend
SKILL.md:1019In the instructionsOpen original file
# USWDS (US Web Design System)npm install uswds
SKILL.md:1022In the instructionsOpen original file
# Atlassian Design System (Atlaskit)yarn add @atlaskit/css-reset @atlaskit/tokens @atlaskit/button @atlaskit/badge @atlaskit/section-message @atlaskit/card
SKILL.md:1025In the instructionsOpen original file
# Bootstrap 5.3npm install bootstrap
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
High risk

May create unverified customer endorsements and realistic fictional identities

Source references: 4
What we found

When a page includes a “Trusted by / Used by” section, the Skill directs the agent to use real companies’ SVG logos. It also asks for realistic names, believable photo placeholders, and “organic” numbers instead of obvious placeholder content. Without supplied, authorized customers, reviewers, or metrics, these rules can make fabricated content look genuine.

Why this matters

Visitors could mistake real companies for customers or endorsers and treat fictional people, photos, or metrics as genuine social proof. This can affect purchasing, investment, or partnership decisions and create trademark, advertising-truthfulness, and reputational exposure.

For customer-proof walls, the Skill requires real-company SVGs and elsewhere favors realistic names, avatars, and natural-looking numbers, without requiring that customers, reviewers, or metrics be supplied or verified. If the agent fills gaps, visitors could mistake fiction for real endorsement. The user can require only supplied, authorized proof and explicit labels for examples.

SKILL.md:276In the instructionsOpen original file
**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos:* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.* **Alternative: devicon** for tech-stack logos (`@svgr/cli` or CDN).* **Make-up the brand name? Then make-up an SVG mark too.** Generate a simple monogram (one letter in a circle, two-letter ligature, abstract glyph) rendered as an inline `<svg>` matching the page style. Plain text wordmarks for invented brand names look generic.* **Always** ensure logos render in both light and dark mode (white-on-dark, black-on-light, or single-color theme variable).* **LOGO-ONLY rule (mandatory):** logo wall = logos and nothing else. Do NOT print industry / category labels below each logo (no `Vercel` + `hosting` underneath, no `Stripe` + `payments`, no `Cloudflare` + `infra`). The logo is the credibility, the label adds nothing the user does not already know. Optional: brand name as alt-text for screen readers, optional link to the brand's site. That is it.
Show 3 other places
SKILL.md:615In the instructionsOpen original file
### 9.D Content & Data ("Jane Doe" Effect)* **NO generic names.** "John Doe", "Sarah Chan", "Jack Su" → use creative, realistic, locale-appropriate names.* **NO generic avatars.** No SVG "egg" or Lucide user icons → use believable photo placeholders or specific styling.* **NO fake-perfect numbers.** Avoid `99.99%`, `50%`, `1234567`. Use organic, messy data (`47.2%`, `+1 (312) 847-1928`).* **NO startup-slop brand names.** "Acme", "Nexus", "SmartFlow", "Cloudly" → invent contextual, premium names that sound real.* **NO filler verbs.** "Elevate", "Seamless", "Unleash", "Next-Gen", "Revolutionize" → concrete verbs only.
SKILL.md:327In the instructionsOpen original file
  Rewrite every flagged string. If unsure whether a string makes sense, replace it with a plain functional sentence. AI-generated cute copy is worse than boring copy.* **Fake-precise numbers are flagged.** Numbers like `92%`, `4.1×`, `48k`, `5.8 mm`, `13.4 lb` either:  - Come from real data (brief, brand guidelines, public metrics) - fine  - Are explicitly labeled as mock (`<!-- mock -->`, "example", "sample data") - fine  - Are AI-invented spec aesthetics - banned. Don't fake engineering precision the brand doesn't claim.* **One copy register per page.** Don't mix technical mono ("47 tasks · 0.6 ctx-switches/day"), editorial prose, and marketing punch in the same composition unless the brand voice explicitly calls for it.
SKILL.md:616In the instructionsOpen original file
### 9.D Content & Data ("Jane Doe" Effect)* **NO generic names.** "John Doe", "Sarah Chan", "Jack Su" → use creative, realistic, locale-appropriate names.* **NO generic avatars.** No SVG "egg" or Lucide user icons → use believable photo placeholders or specific styling.* **NO fake-perfect numbers.** Avoid `99.99%`, `50%`, `1234567`. Use organic, messy data (`47.2%`, `+1 (312) 847-1928`).* **NO startup-slop brand names.** "Acme", "Nexus", "SmartFlow", "Cloudly" → invent contextual, premium names that sound real.* **NO filler verbs.** "Elevate", "Seamless", "Unleash", "Next-Gen", "Revolutionize" → concrete verbs only.

Inside this skill

1 instruction sections

The Skill first infers a design direction from the page type, audience, existing brand assets, and constraints, then selects a design system, layout, motion, and content rules. It is primarily intended for landing pages, portfolios, and redesigns.

View source
SKILL.md:17In the instructionsOpen original file
### 0.A Read these signals first1. **Page kind** - landing (SaaS / consumer / agency / event), portfolio (dev / designer / creative studio), redesign (preserve vs overhaul), editorial / blog.2. **Vibe words** the user used - "minimalist", "calm", "Linear-style", "Awwwards", "brutalist", "premium consumer", "Apple-y", "playful", "serious B2B", "editorial", "agency-y", "glassy", "dark tech".3. **Reference signals** - URLs they linked, screenshots they pasted, products they named, brands they're competing with.4. **Audience** - B2B procurement panel vs. design-conscious consumer vs. recruiter scanning a portfolio. The audience picks the aesthetic, not your taste.5. **Brand assets that already exist** - logo, color, type, photography. For redesigns, these are starting material, not optional input (see Section 11).6. **Quiet constraints** - accessibility-first audiences, public-sector, regulated industries, trust-first commerce, kids' products. These constraints OVERRIDE aesthetic preference.
SKILL.md:896In the instructionsOpen original file
## 13. OUT OF SCOPEThis skill is NOT for:* Dashboards / dense product UI / admin panels (use Fluent, Carbon, Atlassian, or Polaris from Section 2.A).* Data tables (use TanStack Table or AG Grid).* Multi-step forms / wizards (use Form-specific patterns; this skill won't make them better).* Code editors (use Monaco / CodeMirror with their official skinning).* Native mobile (use Apple HIG / Material directly).* Realtime collab UIs (presence, cursors, OT-aware - different problem class).

For redesigns, it requires an audit of the existing brand, information architecture, content, SEO, accessibility, and analytics, and prohibits silently changing routes, navigation, forms, logos, or legal text without explicit approval.

View source
SKILL.md:794In the instructionsOpen original file
### 11.B Audit Before TouchingDocument the current state before proposing changes:* **Brand tokens** - primary / accent colors, type stack, logo treatment, radii.* **Information architecture** - page tree, primary nav, key conversion paths.* **Content blocks** - what exists, what's doing work, what's filler.* **Patterns to preserve** - signature interactions, recognisable hero, copy voice.* **Patterns to retire** - AI-slop tells, broken layouts, dead links, generic stock imagery, perf traps.* **Dial reading of the existing site** - infer current `DESIGN_VARIANCE` / `MOTION_INTENSITY` / `VISUAL_DENSITY`. That's your starting point, not the baseline.* **SEO baseline** - current ranking pages, meta titles, structured data, OG cards. **SEO migration is the #1 redesign risk.**
SKILL.md:825In the instructionsOpen original file
### 11.F What Never Changes SilentlyNever modify without explicit user approval:* URL structure / route slugs.* Primary nav labels.* Form field names or order (breaks analytics + autofill).* Brand logo or wordmark.* Existing legal / consent / cookie copy.

The Skill contains copyable React animation examples. They register GSAP ScrollTrigger in client-side code and revert the animation context on component cleanup, while also requiring respect for reduced-motion preferences.

View source
SKILL.md:367In the instructionsOpen original file
```tsx"use client";import { useRef, useEffect } from "react";import { gsap } from "gsap";import { ScrollTrigger } from "gsap/ScrollTrigger";import { useReducedMotion } from "motion/react";gsap.registerPlugin(ScrollTrigger);
SKILL.md:406In the instructionsOpen original file
      });    }, ref);    return () => ctx.revert();  }, [reduce]);
SKILL.md:525In the instructionsOpen original file
### 6.B Reduced Motion (mandatory)* **Any motion above `MOTION_INTENSITY > 3` MUST honor `prefers-reduced-motion`.** This is non-negotiable.* In Motion: wrap with `useReducedMotion()` and degrade to static.* In CSS: gate animations behind `@media (prefers-reduced-motion: no-preference)` or provide an override block under `@media (prefers-reduced-motion: reduce)` that disables.* Infinite loops, parallax, scroll-hijack, and magnetic physics MUST collapse to static / instant under reduced motion.

The pre-flight checklist covers responsive layout, contrast, animation cleanup, dark mode, and Core Web Vitals, but it is an instruction to the agent and does not prove that a generated site actually passed browser, accessibility, or performance testing.

View source
SKILL.md:964In the instructionsOpen original file
- [ ] **Motion claimed = motion shown**: if `MOTION_INTENSITY > 4`, page actually animates, not just claimed?- [ ] **GSAP sticky-stack / horizontal-pan** implemented per Section 5.A / 5.B canonical skeleton (`start: "top top"`, `pin: true`, correct scrub)?- [ ] **No `window.addEventListener('scroll')`** - using Motion `useScroll()` / ScrollTrigger / IntersectionObserver / CSS scroll-driven animations only?- [ ] **Reduced motion** wrapped for everything `MOTION_INTENSITY > 3`?- [ ] **Dark mode** tokens defined and tested in both modes?- [ ] **Mobile collapse** explicit (`w-full`, `px-4`, `max-w-7xl mx-auto`) for high-variance layouts?- [ ] **Viewport stability**: `min-h-[100dvh]`, never `h-screen`?- [ ] **`useEffect` animations** have strict cleanup functions?- [ ] **Empty / loading / error** states provided?- [ ] **Cards omitted** in favor of spacing where possible?- [ ] **Icons** from an allowed library only (Phosphor / HugeIcons / Radix / Tabler), no hand-rolled SVG paths?- [ ] **Motion** isolated in client-leaf components with `'use client'` at the top, memoized?- [ ] **No AI Tells** from Section 9 (Inter as default, AI-purple, three-equal cards, Jane Doe, Acme, "Quietly in use at")?- [ ] **Core Web Vitals** plausibly hit (LCP < 2.5s, INP < 200ms, CLS < 0.1)?- [ ] **One design system** per project (no Material + shadcn mixed)?
Start here · InstructionsSKILL.md
design-taste-frontend
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Install extra software packages
SKILL.md:99In the instructionsOpen original file
| Modern accessible React foundation | `@radix-ui/themes` | Primitives + polished theme || Modern SaaS where you own the components | shadcn/ui (`npx shadcn@latest add ...`) | You own the code, easy to customise; never ship default state || Tailwind-based modern SaaS / AI marketing | Tailwind v4 utilities + `dark:` variant | Default for indie + small team builds |
SKILL.md:991In the instructionsOpen original file
# Material Web (Material 3)npm install @material/web
SKILL.md:994In the instructionsOpen original file
# Fluent UI React (v9)npm install @fluentui/react-components
Connect to websites
SKILL.md:269In the instructionsOpen original file
2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:   * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)   * Actual stock or brand URLs when the brief provides them
SKILL.md:277In the instructionsOpen original file
**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos:* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.* **Alternative: devicon** for tech-stack logos (`@svgr/cli` or CDN).
SKILL.md:626In the instructionsOpen original file
* **NO div-based fake screenshots.** Never build a fake product UI out of `<div>` rectangles to simulate a screenshot. Use real images, generated images, or skip the preview.* **NO broken Unsplash links.** Use `https://picsum.photos/seed/{descriptive-string}/{w}/{h}`, or generated photo placeholders, or actual assets.* **shadcn/ui customization:** Allowed, but NEVER in default state. Customize radii, colors, shadows, typography to the project aesthetic.
Run commands
SKILL.md:989In the instructionsOpen original file
```bash# Material Web (Material 3)
Read keys or account settings
SKILL.md:1029In the instructionsOpen original file
# Add this to your app HTML head:#   <meta name="shopify-api-key" content="%SHOPIFY_API_KEY%" />#   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>
Lines read
1,207
File checksum (to compare versions)
21ce1373cba1d871489543e1f690a3466b1c9d223002e289cca3f66e31b86461