frontend-imagegen-director — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited frontend-imagegen-director (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill is not a prompt-only mockup generator.
Its default workflow is:
gpt-image2 or the environment's image generation pathIf the user explicitly asks for image-only output, you may stop after the image stage. Otherwise, do not stop at the image.
Before finishing, state which of these outcomes you are delivering:
If the user asked to "draw the front end and then build it", the required outcome is image plus implemented page.
superpowers when it is actually available.superpowers is not available, do the same requirement-discovery discipline manually and explicitly say it is a fallback.gpt-image2 or gpt-image-2 when the environment allows model-path selection.imagegen, use that path and describe it accurately instead of pretending direct model control exists.This skill's intended stack is:
superpowers for requirement discoverygpt-image2 / gpt-image-2 or built-in imagegen for front-end image generationDo not introduce extra dependency skills unless the user explicitly asks for them.
If superpowers exists, use it for requirement discovery before drafting prompts or code.
If it does not exist, ask only the minimum needed questions:
When the user is already specific, do not re-ask what was already answered. Instead, restate the extracted brief and move on.
Before generating any image, present the extracted brief back to the user in a compact confirmation block.
That confirmation must cover:
If the user already gave all of this clearly, do not ask broad new questions. Still restate the brief and wait for confirmation before generating the image.
Do not generate the front-end image until this confirmation step is complete, unless the user explicitly says to proceed without confirmation.
Check the repo for project signals such as:
DESIGN.md, README, landing copy, and product positioningSummarize the result in 3 buckets:
Do not skip this unless the user explicitly wants a fresh direction unrelated to the repo.
Pick one mode:
If the user did not specify a mode, choose the closest fit and say which one you chose.
Every image prompt must include:
If the project is Chinese-first, the default UI copy in the generated image must also be Chinese unless the user asks for another language.
Use gpt-image2 / gpt-image-2 when available.
If the environment only exposes built-in imagegen, use it as the image generation path.
Generate one of these:
State which one you are generating before you generate it.
Unless image generation capability is unavailable, generating the front-end image is mandatory before front-end implementation.
Review the generated image against these checks:
Iterate with targeted prompt changes instead of full restarts when possible.
If the user asked for image-first confirmation, do not start coding until the image direction is accepted.
After the image is approved, implement the real front-end page from it.
Implementation should preserve:
The image is a design contract, not a loose inspiration board. Do not jump straight into code before this stage when the user asked for image-first workflow.
Before finishing, compare the built page against the approved image and report:
For each final run, report:
superpowers or fallback clarification establishedsuperpowers was used unless it was actually available and invoked.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.