Skill

taste-skill

skill:yc-software/qm#taste-skill

Design taste and process for anything a person will look at in a browser — landing page, dashboard, prototype, deck. The default design driver for a browsable artifact, with an anti-slop playbook for the visual language.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:48 UTC at 9432ce5

findings

medium

highest severity

threat classes

2,607

files scanned

263/263

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills-seed/taste-skill:skills-seed/taste-skill/references/tasteskill.md:1082:SUPPLY
suspicious: finding skill:skills-seed/taste-skill:skills-seed/taste-skill/references/tasteskill.md:108:SUPPLY
suspicious: unverified finding skill:skills-seed/taste-skill:skills-seed/taste-skill/SKILL.md:14:SUPPLY

Security findings 3

Supply chain

mediumContextual riskmedium confidence

The design-system table instructs the agent to run `npx shadcn@latest add ...`, fetching and executing an unpinned latest-version remote CLI from npm at install time, a mutable remote-code surface that the declared install-deps capability (install deps and run build steps) does not require to be unpinned, though the package is the official one from the official registry and the instruction is open and purpose-consistent.

skills-seed/taste-skill/references/tasteskill.md:108

`npx shadcn@latest add ...`

vector:instruction

Counter-argument considered

The table row genuinely instructs the unpinned remote CLI call, and although the package is official and the guidance open — which the finding itself concedes — unpinned installs fall outside the pinned official-registry-install carve-out and no declared claim pins versions or requires immutability, so the finding is not shown wrong.

Supply chain

mediumContextual riskhigh confidence

The skill instructs the agent to run unpinned installs such as `npx shadcn@latest init` and bare `npm install` commands for design-system packages, pulling mutable latest versions from the registry at run time instead of pinned versions.

skills-seed/taste-skill/references/tasteskill.md:1082-1084

npx shadcn@latest init

vector:instruction

Counter-argument considered

The appendix genuinely instructs unpinned `@latest` and unversioned installs, which sit outside the carve-out for pinned official-registry installs and are covered by no declared version policy or pinning mitigation; official packages on the official registry bound severity but do not neutralize the mutable-supply surface, so the contextual risk stands.

Supply chain

mediumUnverifiedmedium confidence

taste-skill directs the agent to load and apply whatever sits at runtime under a glob-matched `*-design` Skills-index entry and the popular-web-designs skill, whose content lies outside the consumed artifact and is therefore unreviewable.

skills-seed/taste-skill/SKILL.md:14-16

if the Skills index lists a `*-design` skill, load it

vector:instruction

Open questions 6

What the analysis could not settle from the code alone.

Fifteen PY-CLAIM-CONTRADICTION detector leads (class PERSIST, e.g. excerpts '/', '4', '5', '7', '3', '.md', '--', 'Acme', '@fluentui/tokens', '@carbon/styles') assert that file_write behavior contradicts the preservation rule 'Do not change information architecture unless asked', but every cited unit shown is pure Markdown prose/table text with no write code and the quoted excerpts are isolated tokens from dial values and package names; does any shipped file of this artifact actually perform the⟦… 59 more chars …⟧

Persistence

The playbook instructs generated pages to reference third-party network endpoints (picsum.photos placeholder photography, cdn.simpleicons.org logo SVGs, and the cdn.shopify.com polaris.js script tag in Appendix A); the EXFIL-class lead on cdn.simpleicons.org could not be confirmed as data exfiltration since no host data is sent, but should these remote-content fetches embedded in produced pages be treated as within the declared design purpose or as undeclared network capability?

Data exfiltration

The deterministic leads assert file writes contradicting the rule '- **Do not change information architecture** unless asked.', but the shown spans contain only numeric thresholds (DESIGN_VARIANCE > 4, MOTION_INTENSITY > 5), path/markdown naming separators, and npm package names, not write instructions; confirm whether the skill files contain any actual file-write commands elsewhere.

Persistence

[invalid file request] What do the safety claims at lines 872 and 897 ('Do not change information architecture unless asked.', 'Never modify without explicit user approval:') enumerate — do they cover dependency installation or only the designed page's structure and content? This settles the adjudication of contradictions C2 and C3 (npm install of @fluentui/tokens and @carbon/styles in Appendix A), which I otherwise assess as detector misclassifications of package names as file writes.

Persistence

[file request skills-seed/publish/SKILL.md] How is the /d/<name>/ preview link produced, and does publishing upload workspace files to a remote destination — which host or URL?

Data exfiltration

[file request skills-seed/popular-web-designs/SKILL.md] Does the popular-web-designs skill, which the house-style section instructs the agent to read, contain executable commands, network fetches, or behavior-conditioning instructions beyond visual design vocabulary?

Code execution

Refuted findings 5

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

criticalRefutedlow confidence

The skill instructs the agent to build generated pages around third-party CDN fetches (picsum.photos seeded placeholder images and cdn.simpleicons.org logo SVGs), placing brief-derived descriptors such as seed phrases and brand slugs into outbound URL paths, a declared-core-capability fetch that is only weakly distinguishable from plain web development.

skills-seed/taste-skill/references/tasteskill.md:302

https://cdn.simpleicons.org/{slug}/ffffff

Why it was refuted

Both fetches are declared verbatim in the unit (picsum line 293/D17, Simple Icons line 302/D18, contradicting the DET:34e414651c1da858 residue lead), and the outbound path data is the page's own public content — section-describing seeds and the brand slugs of logos displayed on the page — making this declared-core-capability web development, not exfiltration, so the harm and undeclared gates fail.

Data exfiltration

criticalRefutedlow confidence

The taste-skill instructs the agent to ship artifacts with the `publish` skill, whose file is repository content no agent consumes, so any upload of workspace files and its destination host are unreviewable at runtime.

skills-seed/taste-skill/SKILL.md:37

when it should outlive the turn ship it with the

Why it was refuted

Shipping the finished deliverable via the environment's publish skill is the openly declared persistence workflow — declared claim D3 explicitly covers publish calls, sandbox-scoped — so only the artifact the user asked to persist leaves, via the platform's own path; this is declared core workflow, not covert exfiltration, and the undeclared gate fails.

Supply chain

highRefutedhigh confidence

The skill instructs the agent to embed Shopify's unpinned hosted script from cdn.shopify.com into application pages, loading remote JavaScript whose version is not pinned.

skills-seed/taste-skill/references/tasteskill.md:1104-1107

<script src=⟦U+200B⟧

Why it was refuted

The cited line is a commented vendor include inside Appendix A's fenced install block, scoped to Shopify apps and Shopify's official CDN — matching the vendor-installers-in-fenced-install-docs carve-out — and the finding's quoted '<script src=⟦U+200B⟧' does not exist in the unit, which shows a plain script tag with no hidden character, so the concealment implication is unsupported and the undeclared gate fails too.

Supply chain

highRefutedlow confidence

The skill's Appendix B heading instructs the agent to read the listed remote design-system documentation at mutable, unpinned URLs before writing its own components, routing instruction intake through external content whose future content is not fixed by the artifact.

skills-seed/taste-skill/references/tasteskill.md:1110-1111

## Appendix B - Canonical Sources (read these before reinventing)

Why it was refuted

The canonical-source URLs are themselves declared network capability claims (D30–D32) and the artifact explicitly declares the appendices supply real canonical doc links to ground decisions; reading official vendor documentation is the declared design process, so undeclared external instruction intake is not established and the undeclared and harm gates fail.

Supply chain

highRefutedlow confidence

The house-style section conditionally instructs the agent to read the `popular-web-designs` skill (and load glob-matched `*-design` skills from the index), whose file is repository content no agent consumes, so the agent applies instructions at runtime that cannot be reviewed for embedded commands or conditioning.

skills-seed/taste-skill/SKILL.md:20

the `popular-web-designs` skill for the visual vocabulary

Why it was refuted

Reading the named sibling skill for a known brand's vocabulary is openly instructed in the skill's primary body as its declared brand-matching process (same unit as declared claim D1); nothing is concealed or contradictory, so the undeclared gate fails and the behavior is the declared core capability, not an undeclared supply vector.

Coverage gaps 19

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

desktop/assets/qm.icns

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/encrypted.pdf

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/hostile.pdf

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.doc

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/sample.pdf

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.ppt

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.pptx!/ppt/printerSettings/printerSettings1.bin

context:unanalyzable_binary binary content is only byte-scanned

test/fixtures/documents/sample.xls

context:unanalyzable_binary pdf content is only byte-scanned

test/fixtures/documents/scanned.pdf

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/dev-instance/SKILL.md

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/update-qm/SKILL.md

skill_frontmatter_invalid missing name/description frontmatter

.claude/skills/upstream-pr/SKILL.md