跳转到正文
报告库
用途分类 / 开发辅助

Image To Code Skill 安全审计

作者说它能做什么(原文)

Elite website image-to-code skill for Codex. For visually important web tasks, it must first generate the design image(s) itself, deeply analyze them, then implement the website to match them as closely as possible. In Codex, it must prefer large, readable, section-specific images instead of tiny compressed boards, generate fresh standalone images for sections or detail views instead of cropping o

第三方安全检查结论

发现安全风险

已检查文件
1
发现的风险
2
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。未发现风险
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。发现 2 项风险
中风险

无明确预算上限的强制多图生成可能产生意外费用

原文依据:5 处
发现了什么

该 Skill 不仅强制先调用图像生成,还明确偏好“生成太多”而非太少,并要求在不清楚时为同一区块生成第二或第三张图。一个 8–12 区块页面可能因此触发大量计费生成和重试。

为什么需要注意

如果图像服务按次或按额度计费,用户可能在前端编码开始前就消耗明显的付费额度、配额和时间。

该风险有源码支持。视觉网站任务会先强制生成图片,并按区块数量偏好一一区块一张;复杂或不清晰的区块还可能产生额外图片或重新生成。若所用图像服务按次或按量计费,8–12 个区块及重试可能造成用户未预期的费用。源码未见总张数、重试次数或预算上限。用户可要求作者加入生成前的数量/费用预估、明确上限及超限确认。

SKILL.md:114来自说明文档打开原文件
For website design requests where visual quality matters, image generation is mandatory first.This means:1. generate the design image or image set yourself first2. deeply inspect and analyze the generated image(s)3. extract the design system from them4. implement the frontend only after that
查看另外 4 个位置
SKILL.md:153来自说明文档打开原文件
Strong rule:- it is better to generate too many clear images than too few compressed images- it is better to generate one clear image per section than one unreadable board for the whole site- it is better to create an extra detail image than to guess details laterNever reduce image count just for convenience if that harms quality.
SKILL.md:169来自说明文档打开原文件
Default rule inside Codex:- 1 section requested → generate 1 image- 2 sections requested → generate 2 images- 3 sections requested → generate 3 images- 4 sections requested → generate 4 images- 5 sections requested → generate 5 images- 6 sections requested → generate 6 images- 7 sections requested → generate 7 images- 8 sections requested → generate 8 images- 9 sections requested → generate 9 images- 10 sections requested → generate 10 images- and so on when reasonable
SKILL.md:285来自说明文档打开原文件
Do not hesitate to create a second or third extraction-oriented image for a section if the first image is too broad.
SKILL.md:646来自说明文档打开原文件
If the user asks for:- a hero only → generate 1 hero image- 4 sections → generate 4 section images- 8 sections → generate 8 section images- 12 sections → generate 12 section images when reasonableGeneral preference:- one section = one primary image- one complex section = one primary image + one or more optional detail images- one unclear section = regenerate it again as a fresh clean standalone image
中风险

可能把模型生成的价格、评价身份和营销文案当作事实发布

原文依据:4 处
发现了什么

参考图由模型自行生成,但该 Skill 随后要求提取其中的定价标签、功能名称、评价者姓名和职务等文字,并在实现时使用可读文字、忠实复制参考图。它没有要求依据用户提供的真实业务资料核验这些内容。

为什么需要注意

生成图中的虚构价格、人物背书、职位或产品承诺可能进入真实网站,误导访客、损害信誉,并带来消费者保护或虚假宣传风险。

该风险有源码支持,但只在生成图片含模型虚构且清晰可读的业务文案时发生。Skill 先自行生成参考图,随后要求提取并使用其中的价格、功能、评价者姓名与职务,还要求实现忠实于参考图;源码未要求用用户提供的真实资料核验这些声明。这可能把虚构价格、人物背书或产品能力发布为事实,影响访客决策并带来声誉或合规风险。用户可限制为占位文案,并要求发布前逐项核验。

SKILL.md:55来自说明文档打开原文件
IMPORTANT:For visual website tasks, you must first generate the design image(s) yourself.Then you must deeply analyze the generated image(s).Only after that should you implement the frontend.Do not skip image generation when image generation is available.Do not begin with freeform coding first.The generated image(s) are the primary visual source of truth.
查看另外 3 个位置
SKILL.md:723来自说明文档打开原文件
When text is readable in the generated section image, extract it and use it.Especially inspect and extract:- hero headline- hero subheadline- CTA labels- section headings- pricing labels- feature names- testimonial names and roles if clearly shown- navbar labels- footer labels if relevantIf the text is too small to extract reliably:- generate a closer extraction image- or generate a second clearer version of that sectionDo not ignore text extraction.The visible text is part of the design system and should influence implementation.
SKILL.md:837来自说明文档打开原文件
After generating and analyzing the reference image(s), implement the website in a copy-oriented way.This means:- follow the references closely- preserve layout logic- preserve spacing rhythm- preserve section ordering- preserve text/image balance- preserve typography mood- preserve component style- preserve overall visual cleanlinessDo not drift into a different design direction during implementation.Do not “improve” the design by replacing it with a generic coded layout.The goal is not:- inspired by the imageThe goal is:- visually faithful to the image, translated into real frontend
SKILL.md:114来自说明文档打开原文件
For website design requests where visual quality matters, image generation is mandatory first.This means:1. generate the design image or image set yourself first2. deeply inspect and analyze the generated image(s)3. extract the design system from them4. implement the frontend only after that

Skill 逻辑拆解

8 个说明模块

该 Skill 针对视觉类网站任务规定固定顺序:先生成参考图,再分析图像,最后实现前端;生成图被视为主要设计依据。

查看原文
SKILL.md:55来自说明文档打开原文件
IMPORTANT:For visual website tasks, you must first generate the design image(s) yourself.Then you must deeply analyze the generated image(s).Only after that should you implement the frontend.Do not skip image generation when image generation is available.Do not begin with freeform coding first.The generated image(s) are the primary visual source of truth.

在 Codex 中,该 Skill 默认按页面区块分别生成大图,并在细节不清楚时继续生成额外图像或重新生成。

查看原文
SKILL.md:168来自说明文档打开原文件
Default rule inside Codex:- 1 section requested → generate 1 image- 2 sections requested → generate 2 images- 3 sections requested → generate 3 images- 4 sections requested → generate 4 images- 5 sections requested → generate 5 images- 6 sections requested → generate 6 images- 7 sections requested → generate 7 images- 8 sections requested → generate 8 images- 9 sections requested → generate 9 images- 10 sections requested → generate 10 images- and so on when reasonable
SKILL.md:261来自说明文档打开原文件
If a section image still does not expose the necessary detail clearly enough, generate an additional detail image for that same section.Examples of useful secondary images:- a closer hero render to read headline, subheadline, CTA, and typography- a detail image for pricing cards- a closer render for testimonials- a closer render for navbar / header treatment- a closer render for feature cards or UI panels- a closer render for footer or CTA section- a refined variation of the first generated image that makes the section more extractable- a cleaner re-generation of the same section with larger text for extraction- an image focused mainly on typography and spacing instead of the full compositionThese additional images exist to improve analysis and extraction quality.Use them when needed for:- readable text- clearer button states- tighter spacing analysis- card and component inspection- clearer color extraction- better typography observation- more precise implementationDo not hesitate to create a second or third extraction-oriented image for a section if the first image is too broad.
从这里开始 · 工作说明SKILL.md
image-to-code
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。 另有 30 个章节,可在原文件中查看。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明
读取了多少行
1,229
文件校验值(用于核对版本)
a72df672701f11e780a83210459d8fa6db56b6583efa0854a099e786ff49f843