design-to-code — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited design-to-code (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn an approved visual source into maintainable code without relying on prose precision. Prefer structured inputs, small implementation passes, and screenshot-backed parity evidence.
design-to-code owns work after design approval/handoff:
data-section anchors and section-level parity evidenceReturn to idea-to-design only when the approved source is missing/stale, scope changed, the handoff predates approval, or the user asks for a design change.
implementation-blueprint.json + page-matrix.json + component-blueprint.json + debt-ledger.jsonvisual-ir/<page-id>.json, visual-contracts/*, section crops)Prose briefs are supporting context, not the source of truth.
D2C has one default path: highest-fidelity-regeneration.
Use D2C only when converting or repairing against an approved visual source and the expected result is the highest practical design-source fidelity. Do not downgrade to quick, standard, or "structure-first" modes unless the user explicitly waives fidelity for that specific task.
For every visual D2C page/section:
Required references for visual D2C work:
references/design-extraction-analysis-gate.mdreferences/full-page-regeneration-guard.mdreferences/high-fidelity-rules.mdreferences/section-driven-high-fidelity.mdreferences/executable-visual-ir.mdreferences/asset-atlas-generation.md when multiple related bitmap assets are neededreferences/functional-component-handoff-guard.md when controls/forms/tabs/pickers affect behaviorNon-visual or minor project-convention edits should not use D2C and must not claim design parity.
These rules are always active for GPT Image 2/mockup work:
references/design-extraction-analysis-gate.md when fidelity depends on a screenshot/mockupreferences/executable-visual-ir.md before more CSSobject-fit or background-position tricksdata-section markers for key sections.Before coding any visual D2C page/section, the required references above must be loaded and applied. Section-level executable IR is mandatory: each major section needs bbox/height or density, component anatomy, text/icon/shape inventory, token targets including mobile typography floors, media/asset role, crop strategy, text safe areas, screenshot target, pass criteria, and must-not-substitute rules.
If any required field is missing, stop and enrich the IR/brief before changing code.
Use generated media by role:
| role | strategy |
|---|---|
| hero main visual | generate as an independent asset |
| CTA/banner background | generate as an independent asset |
| repeated card thumbnails | atlas generation allowed, then crop to independent files |
| application/factory scene groups | atlas generation allowed, then crop to independent files |
| certificates, logos, nav, buttons, labels | render with HTML/CSS/SVG/Iconify; do not bake into images |
Hard rule: an atlas is never a production UI asset. Final code must reference the cropped output files, not use CSS background-position against the atlas to fake separate images.
Use or create a lightweight Visual IR for PNG/GPT Image 2/mockup sources when fidelity matters:
{
"page_id": "application-list",
"route": "/pages/applications/index",
"viewport": [390, 844],
"page_type": "list",
"source_refs": ["design-to-code-inputs/mockup.png"],
"sections": [
{"name": "topbar", "order": 1, "bbox": [0,0,390,72]},
{"name": "card-list", "order": 4, "density": "2.5 cards visible"}
],
"section_anchors": ["topbar", "card-list"],
"must_not_do": ["do not replace list with dashboard"]
}Do not over-model every pixel. Capture page type, section order, bbox, first-screen density, card/list anatomy, action hierarchy, must-not-do, and asset strategy.
For each meaningful checkpoint, report:
references/high-fidelity-rules.md.IdeaToTech only when API/state/permission/cross-platform/verification risk is non-trivial.For visual D2C work, load these before coding; they are not optional or deferred:
references/high-fidelity-rules.md — exactness, text/icon/shape inventory, asset/layer rules, functional-control escalationreferences/design-extraction-analysis-gate.md — design extraction from screenshots/mockups into section IR, component anatomy, asset roles, token targets, must-not-substitute rules, and pass criteriareferences/full-page-regeneration-guard.md — complete-page token table, text inventory, icon anatomy, asset grouping map, and section-level asset planreferences/section-driven-high-fidelity.md — section-by-section restoration and strict visual repairreferences/executable-visual-ir.md — executable section-level layout/asset/anatomy/token contractsreferences/asset-atlas-generation.md — when multiple related bitmap assets are present or may be neededreferences/functional-component-handoff-guard.md — when controls/forms/tabs/pickers affect behaviorreferences/blueprint-driven-implementation.md — when project blueprint files existreferences/visual-measurements.md — extracting sizes, colors, densityreferences/width-normalization.md — canonical page width, responsive/H5 viewport metrics, and real mobile screenshot evidencereferences/mobile-recomposition.md — when desktop/PC-only sources must become mobilereferences/playwright-section-diff.md — screenshot comparison and Mobile H5 visual audit packreferences/main-skill-full-reference.md — if the compact guide is insufficient| Pitfall | Fix |
|---|---|
| Implementing from prose only | Build/read Visual IR and source crops |
| Broad route smoke treated as visual pass | Require section screenshots for parity claims |
| Reusing a dashboard template everywhere | Preserve page type and first-screen anatomy |
| Pixel-chasing before coverage | Cover routes first, then L4/L5 selected pages |
| Coding starts before extracting design | Stop; run design extraction and analysis, then write executable IR before implementation |
| IR only names sections | Add executable IR: bbox/height, density, component anatomy, asset role, token targets, pass criteria, and must-not-substitute rules |
| Repeated CSS tuning still feels unlike source | Stop coding; classify mismatch as asset/structure/anatomy/token/verification and enrich references/executable-visual-ir.md fields first |
| Using one generated atlas as many CSS backgrounds | Crop atlas into independent files and reference cropped assets only |
| Hero/banner mixed into thumbnail atlas | Generate hero/CTA as independent assets with final safe areas |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.