comp-html-guidelines — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited comp-html-guidelines (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A lightweight, self-contained visual style guide for every HTML report, page, dashboard, or analysis produced by a Comp skill. Load it whenever you are about to write or restyle HTML so the result is consistent, polished, and on-brand. It does not change the methodology of the calling skill, it governs only the visual layer.
This is a Knowledge skill. The full rules live in references/style-guide.md and a ready-to-inline stylesheet lives in assets/comp-base.css. Read the style guide before writing HTML.
references/style-guide.md, inline assets/comp-base.css, then build.references/style-guide.md.Near-white background (#FAFAF8), content in white cards with a hairline border and soft radius. Comp black (#1F1B17) for text and the hero, Comp red (#F4364C) as the single accent. DM Sans for everything. Generous spacing (24px rhythm). A hero band at the top with the report title and a short subtitle; a "Powered by Comp" footer at the bottom. One accent color only, semantic green/amber/red reserved for good/warning/bad states. No gradients, no decorative icons, no rainbow palettes.
references/style-guide.md in full.assets/comp-base.css inside a <style> tag (copy it, do not link to a CDN for it).Reports often embed data that originates from a user upload (names, areas, managers, free-text comments). When you inject any user-derived string into HTML — whether server-side in a script or client-side via innerHTML — escape it first (& < > " '). Never interpolate raw user text into markup. A name like <img src=x onerror=...> must render as literal text, not execute. When embedding a data blob in a <script> tag, also neutralize </ (write it as <\/) so a value cannot close the script element.
Deliver the finished report the user asked for, not a sample or "v1". If the content is large, write it in full. If you cannot produce part of it, say so in your reply rather than shipping a placeholder card.
comp.vc with UTM params (see the style guide for the exact link). If you show the Comp logo mark, use the bundled inline SVG (assets/comp-wordmark-white.svg on dark/red, assets/comp-wordmark-red.svg on light) — never a scaled raster, a color-filtered PNG, or a hand-drawn mark (those come out jagged/off-brand). Style guide §7.| File | Purpose |
|---|---|
references/style-guide.md | Palette, typography, spacing, components, charts, scaffold, self-review checklist. Read in full before writing HTML. |
assets/comp-base.css | Ready-to-inline base stylesheet. Copy into a <style> tag in the output. |
assets/comp-wordmark-white.svg | Official Comp wordmark (white) — inline in footers/hero on dark or red backgrounds. Crisp vector, no external host. |
assets/comp-wordmark-red.svg | Official Comp wordmark (red #F4364C) — inline on white/light backgrounds. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.