beautiful-article
把用户提供的素材（网页 URL / PDF / DOCX / Markdown / 纯文本 / 截图 / 粘贴材料）编辑、设计成一篇美丽的、可离线打开和分享的**单文件 HTML 网页文章**。基于 reacticle 组件协议：不手写裸 HTML/CSS，而用语义组件 + 受主题约束的 Raw 自由层；按 source→规划→双确认→生成→终审→修复的小型 harness 流程推进，默认 100% 信息保留的长文。触发场景：把 URL/PDF/DOCX/文章做成网页文章 / 长文 / briefing / 解释文 / 视觉文章 / 教程 / 审阅复盘 / 方案分析，'render this as a beautiful web article / 把这篇做成网页文章 / 生成一篇可分享的 HTML 长文 / reacticle 文章'。只生成文章，不生成后台、表单、dashboard、产品原型或通用 Web App。
72
88%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md 所述 Phase 1 “Source → Markdown” 会将用户提供的 URL/PDF/DOCX/文本等先抽取为 `source/source.md`（并对 URL 进行网页正文抓取/提取），该 `source.md` 随后在 Phase 2+ 被主 Agent 读取进入 LLM 上下文，因此存在“公网上抓取的/外部文档正文”作为不受操作者选择的免费文本被喂入上下文的间接提示注入风险。
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The scaffold script (scripts/scaffold.sh) runs npm to install the latest "reacticle" and the scaffold template includes an npm registry setting (registry=https://registry.npmjs.org/), so at runtime the skill fetches and installs remote npm code (which is then built/executed) from https://registry.npmjs.org/ — a required external dependency that causes remote code to be fetched and run.
- Repository
- ConardLi/garden-skills
- Commit
aaf9a82
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.