跳转到正文
报告库
用途分类 / 其他用途

Design Taste Frontend Skill 安全审计

作者说它能做什么(原文)

Anti-slop frontend skill for landing pages, portfolios, and redesigns. The agent reads the brief, infers the right design direction, and ships interfaces that do not look templated. Real design systems when applicable, audit-first on redesigns, strict pre-flight check.

第三方安全检查结论

先别安装或运行

已检查文件
1
发现的风险
5
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。发现 1 项风险
中风险

会建议安装并执行未固定版本的第三方包

原文依据:4 处
发现了什么

该 Skill 要求缺少依赖时先输出安装命令,并提供 `npx shadcn@latest` 以及多个 npm/yarn 安装命令。`@latest` 没有固定版本,执行时会下载并运行当时发布的代码;安装脚本也可能运行第三方生命周期脚本。

为什么需要注意

如果用户或代理直接执行这些命令,项目依赖和文件可能被修改。上游包被劫持、版本出现破坏性变化或名称选择错误时,第三方代码可能在开发机或 CI 权限范围内执行。

Skill 强制在缺依赖时先给出安装命令,并提供会下载、执行和写入项目的 `npx shadcn@latest` 命令。`@latest` 明确未固定;其他安装命令也未固定,实际执行还可能触发第三方生命周期脚本。用户可限制为精确版本、锁文件,并在运行前审查包及写入范围。

SKILL.md:156来自说明文档打开原文件
### 3.F Dependency Verification (mandatory)Before importing ANY 3rd-party library, check `package.json`. If the package is missing, output the install command first. **Never** assume a library exists.
查看另外 3 个位置
SKILL.md:1002来自说明文档打开原文件
# Radix Themesnpm install @radix-ui/themes# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input
SKILL.md:1021来自说明文档打开原文件
# Atlassian Design System (Atlaskit)yarn add @atlaskit/css-reset @atlaskit/tokens @atlaskit/button @atlaskit/badge @atlaskit/section-message @atlaskit/card# Bootstrap 5.3npm install bootstrap
SKILL.md:1005来自说明文档打开原文件
# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 2 项风险
中风险

生成的网站可能向外部图片和脚本服务披露访问数据

原文依据:3 处
发现了什么

该 Skill 建议在无法生成图片时嵌入 Picsum、Unsplash、Pexels、Simple Icons 或其他品牌 URL,并为 Shopify 建议加载外部 CDN 脚本。浏览器访问这些资源时,服务提供方通常能收到访问者 IP、时间、浏览器信息以及可能的来源页信息。

为什么需要注意

上线后,页面访问行为可能在未预期的情况下分享给第三方,并受到其可用性、内容变更和隐私政策影响。在受监管、内部或未公开项目中,这也可能泄露页面正在被访问或品牌正在开发的事实。

Skill 建议把 Picsum、品牌 URL、Simple Icons CDN 等远程资源嵌入页面,并给出 Shopify CDN 脚本。网站访客加载这些资源时会直接连接第三方,从而向其暴露至少 IP、请求时间和浏览器请求信息,来源页也可能随策略发送。用户可要求本地托管资源、限制允许域名,并通过 CSP 阻止未批准连接。

SKILL.md:268来自说明文档打开原文件
1. **Image-generation tool first.** If ANY image-gen tool is available in the environment (`generate_image`, MCP image tool, IDE-integrated gen, OpenAI image tools, etc.) you MUST use it to create section-specific assets: hero photography, product shots, texture backgrounds, mood images. Generate at the right aspect ratio for the section. Do not skip this step because hand-rolled CSS feels faster.2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:   * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)   * Actual stock or brand URLs when the brief provides them   * Open-license sources (Unsplash via direct URL, Pexels) if explicitly allowed3. **Last resort: tell the user.** If neither is possible, do NOT fill the page with hand-rolled SVG illustrations or div-based "fake screenshots." Instead, leave clearly-labeled placeholder slots (`<!-- TODO: hero product photo, 1600x1200 -->`) and at the end of the response say: *"This page needs real images at: \[list of placements\]. Please generate or provide them."*
查看另外 2 个位置
SKILL.md:276来自说明文档打开原文件
**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos:* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.* **Alternative: devicon** for tech-stack logos (`@svgr/cli` or CDN).* **Make-up the brand name? Then make-up an SVG mark too.** Generate a simple monogram (one letter in a circle, two-letter ligature, abstract glyph) rendered as an inline `<svg>` matching the page style. Plain text wordmarks for invented brand names look generic.
SKILL.md:1027来自说明文档打开原文件
# Shopify Polaris Web Components (Shopify apps only)# Add this to your app HTML head:#   <meta name="shopify-api-key" content="%SHOPIFY_API_KEY%" />#   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>```
中风险

强制优先使用图片生成服务可能把项目内容发送给外部提供方

原文依据:1 处
发现了什么

只要环境中存在图片生成工具,该 Skill 就要求使用它生成与页面章节相关的产品图、摄影和背景。生成提示通常需要包含简报、产品或品牌细节;文本没有要求先确认工具的数据处理政策或排除机密素材。

为什么需要注意

如果简报、未发布产品、客户名称或专有视觉资产被写入生成提示或作为参考图上传,它们可能离开本地环境并受外部服务的保存、训练或访问政策约束。

只要存在图片生成工具,Skill 就强制生成与章节相关的产品图、摄影和背景;这通常需要把简报中的品牌、产品和视觉细节写入提示。文本没有要求判断工具是否为外部服务、取得同意或排除机密信息,因此在外部生成器条件下可能披露项目内容。用户可要求先确认提供方、数据保留政策和允许发送的字段。

SKILL.md:266来自说明文档打开原文件
**Priority order for visual assets:**1. **Image-generation tool first.** If ANY image-gen tool is available in the environment (`generate_image`, MCP image tool, IDE-integrated gen, OpenAI image tools, etc.) you MUST use it to create section-specific assets: hero photography, product shots, texture backgrounds, mood images. Generate at the right aspect ratio for the section. Do not skip this step because hand-rolled CSS feels faster.2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:   * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)   * Actual stock or brand URLs when the brief provides them   * Open-license sources (Unsplash via direct URL, Pexels) if explicitly allowed3. **Last resort: tell the user.** If neither is possible, do NOT fill the page with hand-rolled SVG illustrations or div-based "fake screenshots." Instead, leave clearly-labeled placeholder slots (`<!-- TODO: hero product photo, 1600x1200 -->`) and at the end of the response say: *"This page needs real images at: \[list of placements\]. Please generate or provide them."*
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。发现 1 项风险
低风险

安装命令没有固定依赖版本

原文依据:13 处
发现了什么

安装命令没有指定依赖版本。同样的命令以后可能下载不同代码,你实际安装的内容可能与这次检查时不同。

为什么需要注意

即使命令和报告没变,以后安装时也可能下载到另一份代码。

该命令使用 `@latest`,会在执行时获取并运行当时发布的 shadcn CLI,而不是经过本次审查的固定版本。只有在选择 shadcn/ui 时才会触发;用户可要求作者给出已审核的精确版本和锁文件。

Material Web 安装命令未指定版本,解析出的代码可随发布时间变化,并可能执行依赖的安装脚本。它仅在选用 Material 时相关;用户可要求精确版本与锁文件。

Fluent UI React 命令未固定版本,因此未来执行可能安装不同代码。风险在用户实际采用该设计系统并运行命令时出现;可要求固定版本并审核锁文件。

两个 Fluent UI 包均未固定版本,安装结果会受当时注册表状态和依赖解析影响。用户可限制为经审核的精确版本并保留锁文件。

Carbon 包没有版本约束,未来同一命令可能取得不同代码及传递依赖。仅在用户选择 Carbon 并执行命令时产生影响;可要求精确版本。

Radix Themes 安装命令未固定版本,因此不能保证执行时取得的是当前审查背景下的版本。用户可要求固定并审核版本及锁文件。

`npx shadcn@latest init` 明确下载并运行最新 CLI;初始化还可能修改项目文件。风险仅在用户执行时发生。用户可要求作者提供固定 CLI 版本、预期文件变更和锁文件。

该 `npx` 命令使用 `@latest` 并会运行 CLI 向项目写入组件;执行内容和生成结果会随版本变化。用户可要求固定版本,并在运行前审阅将新增或覆盖的文件。

Primer Brand 的安装命令未指定版本,因此执行时解析的包和传递依赖可能变化。用户可要求精确版本与锁文件。

GOV.UK Frontend 安装命令未固定版本;即使来源是官方包,未来发布内容仍可能不同。用户可要求固定已审核版本。

USWDS 安装命令没有版本号,同一命令以后可能解析到不同实现和依赖。风险以实际执行为条件;用户可要求版本固定。

该 yarn 命令一次安装多个未固定版本的 Atlaskit 包,扩大了随时间变化的直接与传递依赖范围。用户可要求每个包使用精确版本并审核锁文件。

Bootstrap 命令没有固定版本,因此未来运行可能安装不同代码。只有用户运行该命令时才会改变项目;可要求精确版本和锁文件。

SKILL.md:99来自说明文档打开原文件
| Modern accessible React foundation | `@radix-ui/themes` | Primitives + polished theme || Modern SaaS where you own the components | shadcn/ui (`npx shadcn@latest add ...`) | You own the code, easy to customise; never ship default state || Tailwind-based modern SaaS / AI marketing | Tailwind v4 utilities + `dark:` variant | Default for indie + small team builds |
查看另外 12 个位置
SKILL.md:991来自说明文档打开原文件
# Material Web (Material 3)npm install @material/web
SKILL.md:994来自说明文档打开原文件
# Fluent UI React (v9)npm install @fluentui/react-components
SKILL.md:997来自说明文档打开原文件
# Fluent UI Web Components (framework-free)npm install @fluentui/web-components @fluentui/tokens
SKILL.md:1000来自说明文档打开原文件
# IBM Carbonnpm install @carbon/react @carbon/styles
SKILL.md:1003来自说明文档打开原文件
# Radix Themesnpm install @radix-ui/themes
SKILL.md:1006来自说明文档打开原文件
# shadcn/ui (open code, owned components)npx shadcn@latest initnpx shadcn@latest add button card badge separator input
SKILL.md:1007来自说明文档打开原文件
npx shadcn@latest initnpx shadcn@latest add button card badge separator input
SKILL.md:1013来自说明文档打开原文件
# Primer Brand (GitHub marketing UI)npm install @primer/react-brand
SKILL.md:1016来自说明文档打开原文件
# GOV.UK Frontendnpm install govuk-frontend
SKILL.md:1019来自说明文档打开原文件
# USWDS (US Web Design System)npm install uswds
SKILL.md:1022来自说明文档打开原文件
# Atlassian Design System (Atlaskit)yarn add @atlaskit/css-reset @atlaskit/tokens @atlaskit/button @atlaskit/badge @atlaskit/section-message @atlaskit/card
SKILL.md:1025来自说明文档打开原文件
# Bootstrap 5.3npm install bootstrap
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。发现 1 项风险
高风险

可能生成未经证实的客户背书和逼真的虚构身份

原文依据:4 处
发现了什么

当页面包含“Trusted by / Used by”区域时,该 Skill 要求使用真实公司的 SVG 标志;同时又要求用逼真的姓名、照片占位和“自然”的数字替代明显的占位内容。若简报没有提供已获授权的客户、评价者或指标,这些规则可能把虚构内容呈现得像真实证据。

为什么需要注意

访问者可能误以为真实公司是客户或认可该产品,也可能把虚构人物、头像或指标当作真实社会证明,从而影响购买、投资或合作决策,并带来商标、广告真实性和声誉风险。

在需要客户背书墙时,Skill 要求真实公司 SVG;另处又鼓励“逼真”姓名、头像和自然数字,但没有要求这些客户、评价者或指标必须由简报提供或验证。若代理自行补全,虚构内容可能被访客误认为真实背书。用户可要求仅使用其提供并授权的客户、评价和数据,其余明确标为示例。

SKILL.md:276来自说明文档打开原文件
**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos:* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.* **Alternative: devicon** for tech-stack logos (`@svgr/cli` or CDN).* **Make-up the brand name? Then make-up an SVG mark too.** Generate a simple monogram (one letter in a circle, two-letter ligature, abstract glyph) rendered as an inline `<svg>` matching the page style. Plain text wordmarks for invented brand names look generic.* **Always** ensure logos render in both light and dark mode (white-on-dark, black-on-light, or single-color theme variable).* **LOGO-ONLY rule (mandatory):** logo wall = logos and nothing else. Do NOT print industry / category labels below each logo (no `Vercel` + `hosting` underneath, no `Stripe` + `payments`, no `Cloudflare` + `infra`). The logo is the credibility, the label adds nothing the user does not already know. Optional: brand name as alt-text for screen readers, optional link to the brand's site. That is it.
查看另外 3 个位置
SKILL.md:615来自说明文档打开原文件
### 9.D Content & Data ("Jane Doe" Effect)* **NO generic names.** "John Doe", "Sarah Chan", "Jack Su" → use creative, realistic, locale-appropriate names.* **NO generic avatars.** No SVG "egg" or Lucide user icons → use believable photo placeholders or specific styling.* **NO fake-perfect numbers.** Avoid `99.99%`, `50%`, `1234567`. Use organic, messy data (`47.2%`, `+1 (312) 847-1928`).* **NO startup-slop brand names.** "Acme", "Nexus", "SmartFlow", "Cloudly" → invent contextual, premium names that sound real.* **NO filler verbs.** "Elevate", "Seamless", "Unleash", "Next-Gen", "Revolutionize" → concrete verbs only.
SKILL.md:327来自说明文档打开原文件
  Rewrite every flagged string. If unsure whether a string makes sense, replace it with a plain functional sentence. AI-generated cute copy is worse than boring copy.* **Fake-precise numbers are flagged.** Numbers like `92%`, `4.1×`, `48k`, `5.8 mm`, `13.4 lb` either:  - Come from real data (brief, brand guidelines, public metrics) - fine  - Are explicitly labeled as mock (`<!-- mock -->`, "example", "sample data") - fine  - Are AI-invented spec aesthetics - banned. Don't fake engineering precision the brand doesn't claim.* **One copy register per page.** Don't mix technical mono ("47 tasks · 0.6 ctx-switches/day"), editorial prose, and marketing punch in the same composition unless the brand voice explicitly calls for it.
SKILL.md:616来自说明文档打开原文件
### 9.D Content & Data ("Jane Doe" Effect)* **NO generic names.** "John Doe", "Sarah Chan", "Jack Su" → use creative, realistic, locale-appropriate names.* **NO generic avatars.** No SVG "egg" or Lucide user icons → use believable photo placeholders or specific styling.* **NO fake-perfect numbers.** Avoid `99.99%`, `50%`, `1234567`. Use organic, messy data (`47.2%`, `+1 (312) 847-1928`).* **NO startup-slop brand names.** "Acme", "Nexus", "SmartFlow", "Cloudly" → invent contextual, premium names that sound real.* **NO filler verbs.** "Elevate", "Seamless", "Unleash", "Next-Gen", "Revolutionize" → concrete verbs only.

Skill 逻辑拆解

1 个说明模块

该 Skill 先根据页面类型、受众、品牌资产和约束推断设计方向,再选择设计系统、布局、动效和内容规则;它主要面向落地页、作品集和网站改版。

查看原文
SKILL.md:17来自说明文档打开原文件
### 0.A Read these signals first1. **Page kind** - landing (SaaS / consumer / agency / event), portfolio (dev / designer / creative studio), redesign (preserve vs overhaul), editorial / blog.2. **Vibe words** the user used - "minimalist", "calm", "Linear-style", "Awwwards", "brutalist", "premium consumer", "Apple-y", "playful", "serious B2B", "editorial", "agency-y", "glassy", "dark tech".3. **Reference signals** - URLs they linked, screenshots they pasted, products they named, brands they're competing with.4. **Audience** - B2B procurement panel vs. design-conscious consumer vs. recruiter scanning a portfolio. The audience picks the aesthetic, not your taste.5. **Brand assets that already exist** - logo, color, type, photography. For redesigns, these are starting material, not optional input (see Section 11).6. **Quiet constraints** - accessibility-first audiences, public-sector, regulated industries, trust-first commerce, kids' products. These constraints OVERRIDE aesthetic preference.
SKILL.md:896来自说明文档打开原文件
## 13. OUT OF SCOPEThis skill is NOT for:* Dashboards / dense product UI / admin panels (use Fluent, Carbon, Atlassian, or Polaris from Section 2.A).* Data tables (use TanStack Table or AG Grid).* Multi-step forms / wizards (use Form-specific patterns; this skill won't make them better).* Code editors (use Monaco / CodeMirror with their official skinning).* Native mobile (use Apple HIG / Material directly).* Realtime collab UIs (presence, cursors, OT-aware - different problem class).

对于改版任务,它要求先审计现有品牌、信息架构、内容、SEO、无障碍和分析事件,并禁止在未获明确批准时静默修改路由、导航、表单、标志或法律文本。

查看原文
SKILL.md:794来自说明文档打开原文件
### 11.B Audit Before TouchingDocument the current state before proposing changes:* **Brand tokens** - primary / accent colors, type stack, logo treatment, radii.* **Information architecture** - page tree, primary nav, key conversion paths.* **Content blocks** - what exists, what's doing work, what's filler.* **Patterns to preserve** - signature interactions, recognisable hero, copy voice.* **Patterns to retire** - AI-slop tells, broken layouts, dead links, generic stock imagery, perf traps.* **Dial reading of the existing site** - infer current `DESIGN_VARIANCE` / `MOTION_INTENSITY` / `VISUAL_DENSITY`. That's your starting point, not the baseline.* **SEO baseline** - current ranking pages, meta titles, structured data, OG cards. **SEO migration is the #1 redesign risk.**
SKILL.md:825来自说明文档打开原文件
### 11.F What Never Changes SilentlyNever modify without explicit user approval:* URL structure / route slugs.* Primary nav labels.* Form field names or order (breaks analytics + autofill).* Brand logo or wordmark.* Existing legal / consent / cookie copy.

该 Skill 包含可直接复制的 React 动效示例;示例在客户端注册 GSAP ScrollTrigger,并在组件卸载时撤销上下文。它也要求尊重减少动态效果的系统偏好。

查看原文
SKILL.md:367来自说明文档打开原文件
```tsx"use client";import { useRef, useEffect } from "react";import { gsap } from "gsap";import { ScrollTrigger } from "gsap/ScrollTrigger";import { useReducedMotion } from "motion/react";gsap.registerPlugin(ScrollTrigger);
SKILL.md:406来自说明文档打开原文件
      });    }, ref);    return () => ctx.revert();  }, [reduce]);
SKILL.md:525来自说明文档打开原文件
### 6.B Reduced Motion (mandatory)* **Any motion above `MOTION_INTENSITY > 3` MUST honor `prefers-reduced-motion`.** This is non-negotiable.* In Motion: wrap with `useReducedMotion()` and degrade to static.* In CSS: gate animations behind `@media (prefers-reduced-motion: no-preference)` or provide an override block under `@media (prefers-reduced-motion: reduce)` that disables.* Infinite loops, parallax, scroll-hijack, and magnetic physics MUST collapse to static / instant under reduced motion.

交付前检查覆盖响应式布局、对比度、动效清理、暗色模式和核心网页指标,但这是给代理的检查指令,并不能证明生成的网站已实际通过浏览器、无障碍或性能测试。

查看原文
SKILL.md:964来自说明文档打开原文件
- [ ] **Motion claimed = motion shown**: if `MOTION_INTENSITY > 4`, page actually animates, not just claimed?- [ ] **GSAP sticky-stack / horizontal-pan** implemented per Section 5.A / 5.B canonical skeleton (`start: "top top"`, `pin: true`, correct scrub)?- [ ] **No `window.addEventListener('scroll')`** - using Motion `useScroll()` / ScrollTrigger / IntersectionObserver / CSS scroll-driven animations only?- [ ] **Reduced motion** wrapped for everything `MOTION_INTENSITY > 3`?- [ ] **Dark mode** tokens defined and tested in both modes?- [ ] **Mobile collapse** explicit (`w-full`, `px-4`, `max-w-7xl mx-auto`) for high-variance layouts?- [ ] **Viewport stability**: `min-h-[100dvh]`, never `h-screen`?- [ ] **`useEffect` animations** have strict cleanup functions?- [ ] **Empty / loading / error** states provided?- [ ] **Cards omitted** in favor of spacing where possible?- [ ] **Icons** from an allowed library only (Phosphor / HugeIcons / Radix / Tabler), no hand-rolled SVG paths?- [ ] **Motion** isolated in client-leaf components with `'use client'` at the top, memoized?- [ ] **No AI Tells** from Section 9 (Inter as default, AI-purple, three-equal cards, Jane Doe, Acme, "Quietly in use at")?- [ ] **Core Web Vitals** plausibly hit (LCP < 2.5s, INP < 200ms, CLS < 0.1)?- [ ] **One design system** per project (no Material + shadcn mixed)?
从这里开始 · 工作说明SKILL.md
design-taste-frontend
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

安装其他软件包
SKILL.md:99来自说明文档打开原文件
| Modern accessible React foundation | `@radix-ui/themes` | Primitives + polished theme || Modern SaaS where you own the components | shadcn/ui (`npx shadcn@latest add ...`) | You own the code, easy to customise; never ship default state || Tailwind-based modern SaaS / AI marketing | Tailwind v4 utilities + `dark:` variant | Default for indie + small team builds |
SKILL.md:991来自说明文档打开原文件
# Material Web (Material 3)npm install @material/web
SKILL.md:994来自说明文档打开原文件
# Fluent UI React (v9)npm install @fluentui/react-components
连接外部网站
SKILL.md:269来自说明文档打开原文件
2. **Real web images second.** When no gen tool is available, use real photography sources. Acceptable defaults:   * `https://picsum.photos/seed/{descriptive-seed}/{w}/{h}` for placeholder photography (seed should describe the section, e.g. `marrow-cookware-kitchen`)   * Actual stock or brand URLs when the brief provides them
SKILL.md:277来自说明文档打开原文件
**Real company logos for social proof.** When the brief calls for a "Trusted by / Used by / Customers" logo wall, do NOT default to plain text wordmarks (`<span>Acme Co</span>` styled in a row). Use real SVG logos:* **Source: Simple Icons** (`https://cdn.simpleicons.org/{slug}/ffffff` for any color, or `simple-icons` npm package). Covers most known brands.* **Alternative: devicon** for tech-stack logos (`@svgr/cli` or CDN).
SKILL.md:626来自说明文档打开原文件
* **NO div-based fake screenshots.** Never build a fake product UI out of `<div>` rectangles to simulate a screenshot. Use real images, generated images, or skip the preview.* **NO broken Unsplash links.** Use `https://picsum.photos/seed/{descriptive-string}/{w}/{h}`, or generated photo placeholders, or actual assets.* **shadcn/ui customization:** Allowed, but NEVER in default state. Customize radii, colors, shadows, typography to the project aesthetic.
运行命令
SKILL.md:989来自说明文档打开原文件
```bash# Material Web (Material 3)
读取密钥或账号配置
SKILL.md:1029来自说明文档打开原文件
# Add this to your app HTML head:#   <meta name="shopify-api-key" content="%SHOPIFY_API_KEY%" />#   <script src="https://cdn.shopify.com/shopifycloud/polaris.js"></script>
读取了多少行
1,207
文件校验值(用于核对版本)
21ce1373cba1d871489543e1f690a3466b1c9d223002e289cca3f66e31b86461