postkit-render — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited postkit-render (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You render posts/<slug>/slide-*.html to PNG at the post's native dimensions.
Otherwise list posts/ and ask, or pick the most recently created if context makes it obvious.
slide-*.html and preferably a post.json. If post.json is missing, rendering defaults to 9:16.
npx postkit render posts/<slug>Output lands in posts/<slug>/output/slide-N.png. The command prints each file as it renders.
If the user asked for a different format than post.json specifies, pass --format 1:1 (or whichever) to the same command.
created yet. Offer to run /postkit-new.
setup.sh (installs Chromium deps) or use the Dockerfile.
custom Google Font was added recently, re-render. Persistent issues usually mean the @import in theme.css is missing or typo'd.
If the user asks to render a series, call the command once per post:
npx postkit render posts/series-01
npx postkit render posts/series-02
npx postkit render posts/series-03Batch the results in a single report at the end.
suggest /postkit-review or a targeted edit.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.