Skip to content
Report library
Purpose / Other

Redesign Existing Projects Skill Security Audit

What the author says it does (original text)

Upgrades existing websites and apps to premium quality. Audits current design, identifies generic AI patterns, and applies high-end design standards without breaking functionality. Works with any CSS framework or vanilla CSS.

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

External placeholder images make visitors contact a third party

Source references: 1
What we found

The Skill recommends inserting picsum.photos URLs as page backgrounds. If a finished site retains that remote URL, each visitor’s browser contacts the third party; this is more than a local design change.

Why this matters

The third party may receive visitors’ IP addresses, request times, and metadata normally accompanying image requests. The page also becomes dependent on that service’s availability and returned content.

The Skill explicitly recommends a remote picsum.photos image URL when real assets are unavailable. If the generated site retains that URL, each visitor loading the relevant page may contact the third party, exposing their IP address, access time, and ordinary request metadata. The risk depends on whether the final implementation instead downloads and self-hosts the asset; users can require local assets or an approved image host.

SKILL.md:43In the instructionsOpen original file
- **Random dark sections in a light mode page (or vice versa).** A single dark-background section breaking an otherwise light page looks like a copy-paste accident. Either commit to a full dark mode or keep a consistent background tone throughout. If contrast is needed, use a slightly darker shade of the same palette — not a sudden jump to `#111` in the middle of a cream page.- **Empty, flat sections with no visual depth.** Sections that are just text on a plain background feel unfinished. Add high-quality background imagery (blurred, overlaid, or masked), subtle patterns, or ambient gradients. Use reliable placeholder sources like `https://picsum.photos/seed/{name}/1920/1080` when real assets are not available. Experiment with background images behind hero sections, feature blocks, or CTAs — even a subtle full-width photo at low opacity adds presence.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Directs fabricated content to look like real people, data, and dates

Source references: 3
What we found

The Skill goes beyond presentation changes: it explicitly replaces “fake” round figures with organic-looking values, invents believable brands, and randomizes dates “to appear real.” Applied to customers, performance claims, prices, testimonials, or publication history, this conceals the content’s placeholder or fictional nature.

Why this matters

Visitors could treat invented metrics, identities, companies, timelines, or avatars as genuine evidence and base purchasing, trust, or partnership decisions on them.

The Skill actively directs the agent to replace obvious placeholders with realistic-sounding fictional names and brands, and to randomize dates so they “appear real.” If applied to customer identities, testimonials, performance claims, or publication history, visitors may not recognize the content as fictional or provisional, affecting their decisions. Users can require the author to limit this to clearly labeled demo data.

SKILL.md:79In the instructionsOpen original file
- **Generic names like "John Doe" or "Jane Smith".** Use diverse, realistic-sounding names.- **Fake round numbers like `99.99%`, `50%`, `$100.00`.** Use organic, messy data: `47.2%`, `$99.00`, `+1 (312) 847-1928`.- **Placeholder company names like "Acme Corp", "Nexus", "SmartFlow".** Invent contextual, believable brand names.- **AI copywriting cliches.** Never use "Elevate", "Seamless", "Unleash", "Next-Gen", "Game-changer", "Delve", "Tapestry", or "In the world of...". Write plain, specific language.
Show 2 other places
SKILL.md:86In the instructionsOpen original file
- **Passive voice.** Use active voice: "We couldn't save your changes" instead of "Mistakes were made."- **All blog post dates identical.** Randomize dates to appear real.- **Same avatar image for multiple users.** Use unique assets for every distinct person.- **Lorem Ipsum.** Never use placeholder latin text. Write real draft copy.
SKILL.md:81In the instructionsOpen original file
- **Fake round numbers like `99.99%`, `50%`, `$100.00`.** Use organic, messy data: `47.2%`, `$99.00`, `+1 (312) 847-1928`.- **Placeholder company names like "Acme Corp", "Nexus", "SmartFlow".** Invent contextual, believable brand names.- **AI copywriting cliches.** Never use "Elevate", "Seamless", "Unleash", "Next-Gen", "Game-changer", "Delve", "Tapestry", or "In the world of...". Write plain, specific language.

Inside this skill

5 instruction sections

The Skill reads an existing codebase, audits design issues, and then directly modifies the project. Its stated scope is targeted upgrades within the existing stack, rather than a rewrite or framework migration.

View source
SKILL.md:12In the instructionsOpen original file
1. **Scan** — Read the codebase. Identify the framework, styling method (Tailwind, vanilla CSS, styled-components, etc.), and current design patterns.2. **Diagnose** — Run through the audit below. List every generic pattern, weak point, and missing state you find.3. **Fix** — Apply targeted upgrades working with the existing stack. Do not rewrite from scratch. Improve what's there.
SKILL.md:173In the instructionsOpen original file
- Work with the existing tech stack. Do not migrate frameworks or styling libraries.- Do not break existing functionality. Test after every change.- Before importing any new library, check the project's dependency file first.- If the project uses Tailwind, check the version (v3 vs v4) before modifying config.- If the project has no framework, use vanilla CSS.- Keep changes reviewable and focused. Small, targeted improvements over big rewrites.

Beyond visual styling, the Skill directs changes to page copy, identities, metrics, dates, and avatars, so its effects can extend to factual or commercial information shown to users.

View source
SKILL.md:79In the instructionsOpen original file
- **Generic names like "John Doe" or "Jane Smith".** Use diverse, realistic-sounding names.- **Fake round numbers like `99.99%`, `50%`, `$100.00`.** Use organic, messy data: `47.2%`, `$99.00`, `+1 (312) 847-1928`.- **Placeholder company names like "Acme Corp", "Nexus", "SmartFlow".** Invent contextual, believable brand names.- **AI copywriting cliches.** Never use "Elevate", "Seamless", "Unleash", "Next-Gen", "Game-changer", "Delve", "Tapestry", or "In the world of...". Write plain, specific language.- **Exclamation marks in success messages.** Remove them. Be confident, not loud.- **"Oops!" error messages.** Be direct: "Connection failed. Please try again."- **Passive voice.** Use active voice: "We couldn't save your changes" instead of "Mistakes were made."- **All blog post dates identical.** Randomize dates to appear real.- **Same avatar image for multiple users.** Use unique assets for every distinct person.- **Lorem Ipsum.** Never use placeholder latin text. Write real draft copy.
Start here · InstructionsSKILL.md
redesign-existing-projects
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:43In the instructionsOpen original file
- **Random dark sections in a light mode page (or vice versa).** A single dark-background section breaking an otherwise light page looks like a copy-paste accident. Either commit to a full dark mode or keep a consistent background tone thro - **Empty, flat sections with no visual depth.** Sections that are just text on a plain background feel unfinished. Add high-quality background imagery (blurred, overlaid, or masked), subtle patterns, or ambient gradients. Use reliable placeholder sources like `https://picsum.photos/seed/{name}/1920/1080` when real assets are not available. Experiment with background images behind hero sections, feature blocks, or CTAs — even a subtle full-width photo at low opacity adds presence.
Lines read
179
File checksum (to compare versions)
777c305daf97303dd180fec1d2df7d3bca64264d83cbf291a20881859032c2a2