brand-lock-extractor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited brand-lock-extractor (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The blank brand-packs/_template.md is the single biggest point of friction in shotkit. Nobody wants to hand-author nine sections of brand parameters before they can produce a single storyboard. This skill removes that wall: hand it what you already have, get a filled brand-lock back.
The output is a brand-lock.md in the exact format tools/validate_brand_lock.py validates and every other skill consumes. Same file the pipeline reads, produced from your assets instead of from scratch.
This skill extracts. It does not invent. Every value is sampled from a real asset or flagged as an estimate the user must confirm. A confident-sounding wrong hex is worse than a flagged guess.
Trigger when the user:
If the user has nothing but a vague idea (no assets, no description), they are not extracting, they are authoring. Point them at brand-packs/_template.md and help them fill it directly.
You can work from any one of these. More sources is a better extraction.
| Source | How you read it | Best for |
|---|---|---|
| Website URL | WebFetch homepage + about + one more page | Voice, positioning, palette, type |
| Brand book PDF | Read the PDF | Palette (exact hex), type, motion rules |
| Screenshots / image files | Read the images | Palette (sample pixels), mood, layout |
| Written description | Use directly | Identity, archetype, voice posture |
At minimum you need one source. If the user offers none, ask for the one they have: "What can I work from, a website URL, a brand book PDF, screenshots, or a short description?" One question.
WebFetch the homepage, then try the about page (/about, /about-us, /our-story) and one more (/services, /work, recent blog). Skip pages that 404. The homepage is the floor.Read each file. Brand books carry exact hex and type; screenshots are for sampling color and reading mood.Tell the user what you are pulling. Do not ask follow-ups yet, extract first, confirm gaps at the end.
Read references/extraction-rubric.md. It maps every brand-lock section to where the signal lives and how to read it. Work the nine sections in order:
For every value, hold two things: the value, and where it came from (which asset, which quote, which sampled swatch). You will need the source for the confidence pass.
Each value is one of:
Use templates/brand-lock.md.tpl. Fill every required section, no placeholders left behind. Then append an ## Extraction notes section that lists every inferred and needs confirmation value with its source and your reasoning. This section is the audit trail; it does not break validation (the validator checks the nine required sections are present, extra sections are fine).
Set the footer: Last updated to today, Owner to the user or "extracted", Version: 1.0.
Before you present it, confirm the file would pass validation:
#RRGGBB hex (not a placeholder).Then hand off:
"Here is your brand-lock. I sampled the palette and type from your assets and flagged N values that need your eyes (see Extraction notes). Drop it inbrand-packs/, confirm the flagged values, and runpython tools/validate_brand_lock.py path/to/file.mdto verify. Then:'30-second explainer. Use brand-packs/your-brand.md as the brand lock.'"
Colors are sampled, never guessed. Read them from a brand book, from CSS, or by sampling pixels in a screenshot. If you genuinely cannot determine a color, fill your closest estimate and mark it needs confirmation in Extraction notes. "Navy" is not a palette entry. #0F1F3A is. A wrong hex stated confidently corrupts every downstream prompt.
Identify fonts from the brand book, the site's CSS/font files, or clear visual match. If you cannot identify one, say so and flag it, do not name a plausible-sounding font you did not verify.
Every extracted value traces to an asset. Every inferred value traces to reasoning. This is the same audit-trail discipline as the brand-lock snapshot, applied at extraction time.
It is also the hardest to extract, because brands document what they do, not what they avoid. Infer it from consistency: if every image avoids stock-photo gloss, that is a never. If copy never uses exclamation points, that is a never. Read references/extraction-rubric.md for the method. Do not ship an empty never-list.
"Professional, modern, clean" describes every brand and constrains nothing. Extract contrast clauses that do work: "operator not creator", "warm not precious", "confident without volume". If the assets only support generic adjectives, that is a needs confirmation flag, not a license to ship filler.
The output is a clinical specification. It models the standards the brand-lock enforces. No emojis anywhere. No marketing adjectives about the brand in your own voice, report what the assets show.
references/extraction-rubric.md, section-by-section extraction method and confidence definitions.examples/ contains a worked extraction: the source material provided (input-brief.md) and the brand-lock.md produced from it, including the Extraction notes audit trail. Use it to calibrate the level of specificity and the confidence flagging.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.