Is image-to-code safe to install?

SaferSkills independently audited image-to-code (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.claude/skills/image-to-code/SKILL.md · 1 file

.claude/skills/image-to-code/SKILL.md2.6 KB · Markdown

name: image-to-code

description: Turn a reference image, screenshot, or mockup into token-driven, accessible code — infer the design system from the reference (palette, type scale, spacing, radius, layout archetype), map it to the 3-tier tokens, rebuild it, then verify with the kit's gates. Use when the user provides a design/screenshot and wants matching UI code.

Skill: Image to Code

Reconstruct a design from a visual reference as a real design system, not a one-off copy. Match the system (color/type/spacing language), never lift copyrighted imagery or brand assets.

Steps

Read the reference like a designer. Infer and write down:

Palette — 1 dominant surface family, text colors, 1 primary action + at most 1 accent (sample the hues; don't guess random hex).
Type — family feel (geometric/grotesk/serif), the scale jumps, display vs. body contrast, weights.
Spacing & density — base unit, section rhythm, card padding; airy vs. compact.
Radius & depth — radius language (sharp/soft/pill), shadow vs. hairline separation.
Layout archetype + sequence — full-bleed hero / asymmetric split / bento / editorial stack (taste/design-taste.md → Variance Mandate).

Anchor to a known system if it's close — browse taste/aesthetic-systems.md / python3 scripts/design_systems.py search <term> and adopt that recipe to stabilize decisions.
Build the token theme from the inferred values → 3-tier DTCG (design-tokens skill); generate a single theme.css. Verify every color pair with scripts/contrast.py / scripts/validate_contrast.py (light + dark) — a sampled brand color that fails AA gets adjusted; taste never overrides POUR.
Rebuild layout + components token-driven via frameworks/adapter-protocol.md + components/*: one shared primitive layer, all 8 states, a11y wired, no emoji (lucide), single theme. Apply taste (design-taste.md) so it doesn't regress to generic.
Verify against the reference — render and screenshot it, compare side-by-side to the reference; run node scripts/measure_render.mjs, lint_hardcodes.py, taste_audit.mjs, and npm run verify.

Verification (definition of done)

npm run verify is 100% (tokens resolve, contrast AA light+dark, no hardcodes/emoji, real-render WCAG).
The rebuilt UI uses ONE inferred token theme — no per-section palettes.
A screenshot of the result visibly matches the reference's design language.

Honest limit: this matches the design system, not a pixel-perfect copy. Do not reproduce the reference's photographs, logos, or copyrighted copy — substitute your own or generic placeholders.

image-to-code— agent skill

Is image-to-code safe to install?

Skill: Image to Code

Steps

Verification (definition of done)

Audit the pieces. Scan the whole. Decide.