Skip to content
skillsafebeta
← Report library
Purpose / Other

Gpt Taste Skill Security Audit

What the author says it does (original text)

Elite UX/UI & Advanced GSAP Motion Engineer. Enforces Python-driven true randomization for layout variance, strict AIDA page structure, wide editorial typography (bans 6-line wraps), gapless bento grids, strict GSAP ScrollTriggers (pinning, stacking, scrubbing), inline micro-images, and massive section spacing.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Generated pages load images from a third-party service

Source references: 1
What we found

The Skill explicitly requires picsum.photos URLs. When a visitor opens the generated site, their browser contacts that third party, ordinarily exposing the visitor's IP address, request time, and browser/network metadata, and potentially referrer information. The keyword in the URL can also reveal the selected page theme.

Why this matters

The third party can receive visit metadata and learn the page theme, while image availability and content remain under its control. This may conflict with privacy-sensitive sites or policies that prohibit unapproved external resources.

The instruction requires generated pages to reference remote images from picsum.photos rather than local assets. If a user or visitor loads such a page, the browser would normally contact that third party, exposing request-related network information such as IP and timing. The keyword placed in the seed path is also transmitted and may indicate the page theme. No consent, proxying, or privacy restriction is stated. Users can ask for local assets, a trusted first-party host, or an explicit external-resource opt-in.

SKILL.md:63In the instructionsOpen original file
- **The Meta-Label Ban:** BANNED FOREVER are labels like "SECTION 01", "SECTION 04", "QUESTION 05", "ABOUT US". Remove them entirely. They look cheap and unprofessional.- **Image Context & Style:** Use `https://picsum.photos/seed/{keyword}/1920/1080` and match the keyword to the vibe. Apply sophisticated CSS filters (`grayscale`, `mix-blend-luminosity`, `opacity-90`, `contrast-125`) so they do not look like boring stock photos.- **Creative Backgrounds:** Inject subtle, professional ambient design. Use deep radial blurs, grainy mesh gradients, or shifting dark overlays. Avoid flat, boring colors.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Low risk

The claimed Python execution and rigorous verification are simulated and self-reported

Source references: 3
What we found

The Skill first requires a simulated Python execution, then labels three lines of mock text “Python RNG Execution” and asks the model to confirm or “prove” layout properties. No visible instruction requires actual tests, rendered measurements, or retained verification records.

Why this matters

A user may mistake the design plan for evidence of real execution or rendering validation and over-trust claims about heading line counts, gapless grids, or button contrast. Real fonts, viewport sizes, and content changes can still invalidate those claims.

These are active generation instructions, but they explicitly require a simulated script and “mock Python output.” The later checks only ask the model to state, confirm, or prove properties; they do not require Python execution, browser rendering, accessibility checks, or automated tests. A user should therefore not treat the design plan as actual test evidence, particularly for heading line count, gapless grids, or button contrast across real viewports. Users can ask the author to distinguish simulated planning from measured results and provide reproducible rendering tests.

SKILL.md:14In the instructionsOpen original file
## 1. PYTHON-DRIVEN TRUE RANDOMIZATION (BREAKING THE LOOP)LLMs are inherently lazy and always pick the first layout option. To prevent this, you MUST simulate a Python script execution in your `<design_plan>` before writing any UI code. Use a deterministic seed (e.g., character count of the user prompt modulo math) to simulate `random.choice()` and strictly select:- 1 Hero Architecture (from Section 3)
Show 2 other places
SKILL.md:68In the instructionsOpen original file
## 8. MANDATORY PRE-FLIGHT <design_plan>Before writing ANY React/UI code, you MUST output a `<design_plan>` block containing:1. **Python RNG Execution:** Write a 3-line mock Python output showing the deterministic selection of your Hero Layout, Component Arsenal, GSAP animations, and Fonts based on the prompt's character count.2. **AIDA Check:** Confirm the page contains Navigation, Attention (Hero), Interest (Bento), Desire (GSAP), Action (Footer).3. **Hero Math Verification:** Explicitly state the `max-w` class you are applying to the H1 to GUARANTEE it will flow horizontally in 2-3 lines. Confirm NO stamp icons or spam tags exist.4. **Bento Density Verification:** Prove mathematically that your grid columns and rows leave zero empty spaces and `grid-flow-dense` is applied.5. **Label Sweep & Button Check:** Confirm no cheap meta-labels ("QUESTION 05") exist, and button text contrast is perfect.Only output the UI code after this rigorous verification is complete.
SKILL.md:71In the instructionsOpen original file
2. **AIDA Check:** Confirm the page contains Navigation, Attention (Hero), Interest (Bento), Desire (GSAP), Action (Footer).3. **Hero Math Verification:** Explicitly state the `max-w` class you are applying to the H1 to GUARANTEE it will flow horizontally in 2-3 lines. Confirm NO stamp icons or spam tags exist.4. **Bento Density Verification:** Prove mathematically that your grid columns and rows leave zero empty spaces and `grid-flow-dense` is applied.5. **Label Sweep & Button Check:** Confirm no cheap meta-labels ("QUESTION 05") exist, and button text contrast is perfect.Only output the UI code after this rigorous verification is complete.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill generates React/UI pages and mandates navigation plus an AIDA page structure, wide headings, dense Bento grids, and large vertical spacing.

View source
SKILL.md:23In the instructionsOpen original file
## 2. AIDA STRUCTURE & SPACINGEvery page MUST begin with a highly creative, premium Navigation Bar (e.g., floating glass pill, or minimal split nav).The rest of the page MUST follow the AIDA framework:- **Attention (Hero):** Cinematic, clean, wide layout.- **Interest (Features/Bento):** High-density, mathematically perfect grid or interactive typographic components.- **Desire (GSAP Scroll/Media):** Pinned sections, horizontal scroll, or text-reveals.- **Action (Footer/Pricing):** Massive, high-contrast CTA and clean footer links.**SPACING RULE:** Add huge vertical padding between all major sections (e.g., `py-32 md:py-48`). Sections must feel like distinct, cinematic chapters. Do not cramp elements together.

It requires generated interfaces to use GSAP, @gsap/react, and ScrollTrigger, with effects such as scroll pinning, scaling, fading, text reveals, and card stacking.

View source
SKILL.md:47In the instructionsOpen original file
## 5. ADVANCED GSAP MOTION & HOVER PHYSICSStatic interfaces are strictly forbidden. You must write real GSAP (`@gsap/react`, `ScrollTrigger`).- **Hover Physics:** Every clickable card and image must react. Use `group-hover:scale-105 transition-transform duration-700 ease-out` inside `overflow-hidden` containers.- **Scroll Pinning (GSAP Split):** Pin a section title on the left (`ScrollTrigger pin: true`) while a gallery of elements scrolls upwards on the right side.- **Image Scale & Fade Scroll:** Images must start small (`scale: 0.8`). As they scroll into view, they grow to `scale: 1.0`. As they scroll out of view, they smoothly darken and fade out (`opacity: 0.2`).- **Scrubbing Text Reveals:** Opacity of central paragraph words starts at 0.1 and scrubs to 1.0 sequentially as the user scrolls.- **Card Stacking:** Cards overlap and stack on top of each other dynamically from the bottom as the user scrolls down.

Before writing UI code, it requires a design plan containing simulated Python selection and several self-reported checks; these statements do not themselves prove that code was executed or automatically verified.

View source
SKILL.md:68In the instructionsOpen original file
## 8. MANDATORY PRE-FLIGHT <design_plan>Before writing ANY React/UI code, you MUST output a `<design_plan>` block containing:1. **Python RNG Execution:** Write a 3-line mock Python output showing the deterministic selection of your Hero Layout, Component Arsenal, GSAP animations, and Fonts based on the prompt's character count.2. **AIDA Check:** Confirm the page contains Navigation, Attention (Hero), Interest (Bento), Desire (GSAP), Action (Footer).3. **Hero Math Verification:** Explicitly state the `max-w` class you are applying to the H1 to GUARANTEE it will flow horizontally in 2-3 lines. Confirm NO stamp icons or spam tags exist.4. **Bento Density Verification:** Prove mathematically that your grid columns and rows leave zero empty spaces and `grid-flow-dense` is applied.5. **Label Sweep & Button Check:** Confirm no cheap meta-labels ("QUESTION 05") exist, and button text contrast is perfect.Only output the UI code after this rigorous verification is complete.
Start here · InstructionsSKILL.md
gpt-taste
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:63In the instructionsOpen original file
- **The Meta-Label Ban:** BANNED FOREVER are labels like "SECTION 01", "SECTION 04", "QUESTION 05", "ABOUT US". Remove them entirely. They look cheap and unprofessional.- **Image Context & Style:** Use `https://picsum.photos/seed/{keyword}/1920/1080` and match the keyword to the vibe. Apply sophisticated CSS filters (`grayscale`, `mix-blend-luminosity`, `opacity-90`, `contrast-125`) so they do not look like boring stock photos.- **Creative Backgrounds:** Inject subtle, professional ambient design. Use deep radial blurs, grainy mesh gradients, or shifting dark overlays. Avoid flat, boring colors.
Lines read
75
File checksum (to compare versions)
de5aa528b2a96c2f0d006057564c1560f73f172e03fbd1ee446ee5da8a5671d6