Skip to content
skillsafebeta
← Report library
Purpose / Other

Imagegen Frontend Web Skill Security Audit

What the author says it does (original text)

Elite frontend image-direction skill for generating premium, conversion-aware website design references. CRITICAL OUTPUT RULE — generate ONE separate horizontal image FOR EVERY section. A landing page with 8 sections produces 8 images. Never compress multiple sections into one image. Enforces composition variety (not always left-text / right-image), background-image freedom, varied CTAs, varied he

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

Default multi-image generation may cause unexpected charges or quota use

Source references: 3
What we found

The Skill expands an ambiguous landing-page or full-website request into six or eight separate image generations and explicitly requires completion without stopping early. It does not first require the user to approve that count.

Why this matters

If the image service charges per generation or has a usage quota, an ordinary request can consume multiple charges or substantial quota; larger section counts increase the effect.

When the user says “landing page” or “full website” without a count, the Skill automatically selects 6 or 8 images, generates them separately, and instructs the model not to stop early. If image generation is metered or billed per call, this could consume cost or quota the user did not explicitly confirm. The user can ask for a count and estimated usage confirmation before generation, or impose a per-request image limit.

SKILL.md:14In the instructionsOpen original file
- 12 sections requested -> 12 images- "landing page" with no count -> default to 6 sections -> 6 images- "full website template" -> default to 8 sections -> 8 imagesEach image is one section, generated as its own image call. Never combine multiple sections into one frame. Never return a single tall image that contains the whole page.
Show 2 other places
SKILL.md:931In the instructionsOpen original file
15. run §17 CLARITY CHECK16. **generate every per-section horizontal image, labeled "Section X of N: <name>"**, until the full set is delivered. Do not stop early. Do not summarize. Do not return only one image.
SKILL.md:17In the instructionsOpen original file
Each image is one section, generated as its own image call. Never combine multiple sections into one frame. Never return a single tall image that contains the whole page.
Medium risk

Mocks may present unverified commercial proof or pricing when real material is absent

Source references: 5
What we found

The default site structure includes trust bars, testimonials, pricing, and metrics, while directing the model to use believable short copy and a clear conversion path. The Skill does not require those details to come from user-supplied or approved facts.

Why this matters

If placeholder content is mistaken for publishable copy, a site could display invented endorsements, metrics, testimonials, or prices, misleading prospective customers and creating reputational or compliance risk.

What this evidence establishes

The default structures do include trust bars, testimonials, pricing, and metrics, and the Skill asks for short copy. However, it defines the output as website reference imagery and does not explicitly direct the model to invent real customers, prices, or performance claims or to publish them. Placeholder content could be mistaken for fact, but unverified business claims are not directly required by the cited text. The user can require supplied data only and prominent placeholder labels for proof, pricing, and metrics.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:797In the instructionsOpen original file
### 8-section pack1. Hero2. Trust bar3. Features4. Product showcase5. Benefits / use cases6. Testimonials7. Pricing8. CTA
Show 4 other places
SKILL.md:557In the instructionsOpen original file
Avoid fake brand slop:- Acme- Nexus- Flowbit- Quantumly- NovaCore- obvious nonsense wordmarksUse short, believable, design-friendly copy.
SKILL.md:894In the instructionsOpen original file
### Conversion focusEach section has a job. Even when the design is artistic, the page must read as a real product or brand site:- the hero communicates value in seconds and offers one obvious next action- proof sections (logos, quotes, metrics) feel earned, not stuffed- pricing or CTA sections feel decisive, not buried- the final section closes: a single strong CTA + supporting trust cueAvoid pure mood reels with no funnel logic.
SKILL.md:315In the instructionsOpen original file
## 3. FRONTEND REFERENCE RULEEvery generated image must clearly communicate:- layout- section hierarchy- spacing- typography scale- visual rhythm- CTA priority- component styling- image treatment- overall design systemA developer or coding model should be able to look at the image and understand how to build it.
SKILL.md:565In the instructionsOpen original file
Use short, believable, design-friendly copy.

Inside this skill

2 instruction sections

The Skill contains image-design directions only; the provided source has no scripts, installation steps, network requests, credential access, or file-modification instructions. It requests a separate horizontal design-reference image for each webpage section.

View source
SKILL.md:17In the instructionsOpen original file
Each image is one section, generated as its own image call. Never combine multiple sections into one frame. Never return a single tall image that contains the whole page.
SKILL.md:309In the instructionsOpen original file
Important:These are not coding instructions.They are visual-direction cues the generated design should imply.

When the user does not specify a section count, the Skill selects defaults: six images for a landing page and eight for a full or marketing website, then requires generation to continue until all are delivered.

View source
SKILL.md:407In the instructionsOpen original file
If the request is ambiguous about section count, **default high**:- "hero" -> 1 image- "landing page" / "site template" -> default to 6 sections -> 6 images- "full website" -> default to 8 sections -> 8 images- "marketing site" -> default to 8 sections -> 8 images- "product page" -> default to 6 sections -> 6 images- "portfolio" -> default to 6 sections -> 6 images
SKILL.md:931In the instructionsOpen original file
15. run §17 CLARITY CHECK16. **generate every per-section horizontal image, labeled "Section X of N: <name>"**, until the full set is delivered. Do not stop early. Do not summarize. Do not return only one image.
Start here · InstructionsSKILL.md
imagegen-frontend-web
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
988
File checksum (to compare versions)
fe8a3f2208b5510bd67d78425a8e4bfcdb770649fb29270dc63e401c41907231