跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Gpt Taste Skill 安全审计

作者说它能做什么（原文）

Elite UX/UI & Advanced GSAP Motion Engineer. Enforces Python-driven true randomization for layout variance, strict AIDA page structure, wide editorial typography (bans 6-line wraps), gapless bento grids, strict GSAP ScrollTriggers (pinning, stacking, scrubbing), inline micro-images, and massive section spacing.

第三方安全检查结论

发现安全风险

已检查文件
1
发现的风险
2
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 1 项风险
中风险

生成的页面会从第三方图片服务加载资源

原文依据：1 处
发现了什么

Skill 明确要求使用 picsum.photos URL。页面访客打开生成的网站时，浏览器会直接联系该第三方；通常会向其暴露访客 IP、请求时间、浏览器网络信息，并可能携带来源信息。URL 中的关键词还会透露所选页面主题。

为什么需要注意

第三方可以接收访问元数据并了解页面主题；图片可用性和内容也受该外部服务控制。这可能不符合隐私要求严格或不得使用未批准第三方资源的网站。

该指令要求生成的页面引用 picsum.photos 的远程图片，而不是本地资源。只要用户或访客加载该页面，浏览器通常就会向该第三方发起请求，使其看到请求所需的网络信息（如 IP 和时间）；放入 seed 路径的关键词也会随请求发送，并可能反映页面主题。源码未说明用户同意、代理托管或隐私限制。用户可要求作者改用本地资源、可信自有域名或明确的外部资源开关。

SKILL.md:63来自说明文档打开原文件
- **The Meta-Label Ban:** BANNED FOREVER are labels like "SECTION 01", "SECTION 04", "QUESTION 05", "ABOUT US". Remove them entirely. They look cheap and unprofessional.- **Image Context & Style:** Use `https://picsum.photos/seed/{keyword}/1920/1080` and match the keyword to the vibe. Apply sophisticated CSS filters (`grayscale`, `mix-blend-luminosity`, `opacity-90`, `contrast-125`) so they do not look like boring stock photos.- **Creative Backgrounds:** Inject subtle, professional ambient design. Use deep radial blurs, grainy mesh gradients, or shifting dark overlays. Avoid flat, boring colors.
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。发现 1 项风险
低风险

“Python 执行”和严格验证是模拟及自述，不是实际测试证据

原文依据：3 处
发现了什么

Skill 一方面要求“模拟 Python 脚本执行”，另一方面把三行模拟文本命名为“Python RNG Execution”，随后要求模型自行确认和“证明”布局属性。没有可见指令要求真正运行测试、测量渲染结果或保存验证记录。

为什么需要注意

用户可能把设计计划误认为实际工具执行或渲染验证，从而过度相信标题行数、网格无空位和按钮对比度等结论。真实字体、视口和内容变化仍可能使这些声明失效。

这些是活跃的生成指令，但明确要求“模拟”脚本并输出“mock Python output”；后续验证也只是让模型陈述保证、确认或证明，没有要求执行 Python、浏览器渲染、可访问性检查或自动化测试。因此该设计计划不应被用户当作实际测试证据，尤其不能证明标题行数、网格无空位或按钮对比度在真实视口中成立。用户可要求作者区分模拟计划与实测结果，并提供可复现的渲染测试。

SKILL.md:14来自说明文档打开原文件
## 1. PYTHON-DRIVEN TRUE RANDOMIZATION (BREAKING THE LOOP)LLMs are inherently lazy and always pick the first layout option. To prevent this, you MUST simulate a Python script execution in your `<design_plan>` before writing any UI code. Use a deterministic seed (e.g., character count of the user prompt modulo math) to simulate `random.choice()` and strictly select:- 1 Hero Architecture (from Section 3)
查看另外 2 个位置
SKILL.md:68来自说明文档打开原文件
## 8. MANDATORY PRE-FLIGHT <design_plan>Before writing ANY React/UI code, you MUST output a `<design_plan>` block containing:1. **Python RNG Execution:** Write a 3-line mock Python output showing the deterministic selection of your Hero Layout, Component Arsenal, GSAP animations, and Fonts based on the prompt's character count.2. **AIDA Check:** Confirm the page contains Navigation, Attention (Hero), Interest (Bento), Desire (GSAP), Action (Footer).3. **Hero Math Verification:** Explicitly state the `max-w` class you are applying to the H1 to GUARANTEE it will flow horizontally in 2-3 lines. Confirm NO stamp icons or spam tags exist.4. **Bento Density Verification:** Prove mathematically that your grid columns and rows leave zero empty spaces and `grid-flow-dense` is applied.5. **Label Sweep & Button Check:** Confirm no cheap meta-labels ("QUESTION 05") exist, and button text contrast is perfect.Only output the UI code after this rigorous verification is complete.
SKILL.md:71来自说明文档打开原文件
2. **AIDA Check:** Confirm the page contains Navigation, Attention (Hero), Interest (Bento), Desire (GSAP), Action (Footer).3. **Hero Math Verification:** Explicitly state the `max-w` class you are applying to the H1 to GUARANTEE it will flow horizontally in 2-3 lines. Confirm NO stamp icons or spam tags exist.4. **Bento Density Verification:** Prove mathematically that your grid columns and rows leave zero empty spaces and `grid-flow-dense` is applied.5. **Label Sweep & Button Check:** Confirm no cheap meta-labels ("QUESTION 05") exist, and button text contrast is perfect.Only output the UI code after this rigorous verification is complete.
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 用于生成 React/UI 页面，并强制采用导航栏和 AIDA 页面结构、宽幅标题、密集 Bento 网格以及大段垂直间距。

查看原文
SKILL.md:23来自说明文档打开原文件
## 2. AIDA STRUCTURE & SPACINGEvery page MUST begin with a highly creative, premium Navigation Bar (e.g., floating glass pill, or minimal split nav).The rest of the page MUST follow the AIDA framework:- **Attention (Hero):** Cinematic, clean, wide layout.- **Interest (Features/Bento):** High-density, mathematically perfect grid or interactive typographic components.- **Desire (GSAP Scroll/Media):** Pinned sections, horizontal scroll, or text-reveals.- **Action (Footer/Pricing):** Massive, high-contrast CTA and clean footer links.**SPACING RULE:** Add huge vertical padding between all major sections (e.g., `py-32 md:py-48`). Sections must feel like distinct, cinematic chapters. Do not cramp elements together.

它要求生成的界面使用真实的 GSAP、@gsap/react 和 ScrollTrigger，并加入滚动固定、缩放、淡出、文字揭示及卡片堆叠等动态效果。

查看原文
SKILL.md:47来自说明文档打开原文件
## 5. ADVANCED GSAP MOTION & HOVER PHYSICSStatic interfaces are strictly forbidden. You must write real GSAP (`@gsap/react`, `ScrollTrigger`).- **Hover Physics:** Every clickable card and image must react. Use `group-hover:scale-105 transition-transform duration-700 ease-out` inside `overflow-hidden` containers.- **Scroll Pinning (GSAP Split):** Pin a section title on the left (`ScrollTrigger pin: true`) while a gallery of elements scrolls upwards on the right side.- **Image Scale & Fade Scroll:** Images must start small (`scale: 0.8`). As they scroll into view, they grow to `scale: 1.0`. As they scroll out of view, they smoothly darken and fade out (`opacity: 0.2`).- **Scrubbing Text Reveals:** Opacity of central paragraph words starts at 0.1 and scrubs to 1.0 sequentially as the user scrolls.- **Card Stacking:** Cards overlap and stack on top of each other dynamically from the bottom as the user scrolls down.

在编写 UI 代码前，它要求输出设计计划，包括模拟的 Python 随机选择和若干自述式检查；这些内容本身并不证明代码经过了实际执行或自动验证。

查看原文
SKILL.md:68来自说明文档打开原文件
## 8. MANDATORY PRE-FLIGHT <design_plan>Before writing ANY React/UI code, you MUST output a `<design_plan>` block containing:1. **Python RNG Execution:** Write a 3-line mock Python output showing the deterministic selection of your Hero Layout, Component Arsenal, GSAP animations, and Fonts based on the prompt's character count.2. **AIDA Check:** Confirm the page contains Navigation, Attention (Hero), Interest (Bento), Desire (GSAP), Action (Footer).3. **Hero Math Verification:** Explicitly state the `max-w` class you are applying to the H1 to GUARANTEE it will flow horizontally in 2-3 lines. Confirm NO stamp icons or spam tags exist.4. **Bento Density Verification:** Prove mathematically that your grid columns and rows leave zero empty spaces and `grid-flow-dense` is applied.5. **Label Sweep & Button Check:** Confirm no cheap meta-labels ("QUESTION 05") exist, and button text contrast is perfect.Only output the UI code after this rigorous verification is complete.
从这里开始 · 工作说明SKILL.md
gpt-taste
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

连接外部网站
SKILL.md:63来自说明文档打开原文件
- **The Meta-Label Ban:** BANNED FOREVER are labels like "SECTION 01", "SECTION 04", "QUESTION 05", "ABOUT US". Remove them entirely. They look cheap and unprofessional.- **Image Context & Style:** Use `https://picsum.photos/seed/{keyword}/1920/1080` and match the keyword to the vibe. Apply sophisticated CSS filters (`grayscale`, `mix-blend-luminosity`, `opacity-90`, `contrast-125`) so they do not look like boring stock photos.- **Creative Backgrounds:** Inject subtle, professional ambient design. Use deep radial blurs, grainy mesh gradients, or shifting dark overlays. Avoid flat, boring colors.
读取了多少行
75
文件校验值（用于核对版本）
de5aa528b2a96c2f0d006057564c1560f73f172e03fbd1ee446ee5da8a5671d6