Together AI's web design skill: Sets 16 non-negotiable baselines for agents (colors and fonts must use tokens, no fabricated data or testimonials, the hero section must include a headline and primary button, etc.), offers three directions from a theme library to choose from, then uses sloplint in the browser to check for violations before delivery.
skills.sh installs 74901 (+2635 / 24h)
Security Audit: Risk warnings present
- References unscanned scripts: scripts/sloplint.mjs, scripts/capture.mjs, scripts/theme.mjs
- Audit scope: GitHub nutlope/hallmark/skills/hallmark/SKILL.md (only the SKILL.md text was scanned)
Rationale
- Baselines are enforced via specific CSS rules: no
transition: all, no animatingwidth/height/top/left,htmlandbodyuseoverflow-x: clip, all interactive elements have:focus-visible, and animations includeprefers-reduced-motionfallbacks - Before starting, it asks only four questions once (assets, audience, desired page action, tone); any missing numbers, quotes, or logos are left blank rather than fabricated by the agent
- theme.mjs generates three themes based on prompts and logs them to avoid repeating the same style consecutively; the author states the theme library contains 50 materials and the photo library has 755 openly licensed photos, with attribution required in the footer when used
- skills.sh installs 2635 in 24 hours, totaling 74901; last week saw 6181, while previous weeks were around two thousand (this only indicates attention level)
Usage
npx skills add https://github.com/nutlope/hallmark --skill hallmark(the author's README usesnpx skills add nutlope/hallmark -gfor global installation); a Claude Code plugin is also available- For new pages, simply describe the requirements; for existing pages, specify them explicitly, e.g.,
/hallmark redesign <path>or/hallmark audit <path> - Requires Node 18+; browser checks and screenshots additionally require
npm i -g puppeteer-coreand Chrome. If unavailable, only static checks are run
Risks
- The audit flagged that the sloplint.mjs, capture.mjs, and theme.mjs scripts were not scanned; SKILL.md instructs agents to run them with Node. capture.mjs opens your product URL or dev server to take screenshots, which aligns with its purpose
- The photo library only stores links to Wikimedia Commons and does not include image files; internet access is required to fetch images when used. The scan did not separately list this network dependency
- The workflow requires reading multiple reference files and performing several review rounds; the author also notes that loading extra files is the largest avoidable cost