Skip to content
Back to skills

Coding

ASecurity

Create high-fidelity UI designs, color palettes, and design systems

  • 23 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added October 14, 2026
ai-agentsrustgoreactrailsapisecurity

Works with

  • cli
  • api

Security analysis

A100/100

Pro scans all 21 files and shows the line behind each finding

Scanned October 14, 2026

npx -y skills add andreibesleaga/GABBE --skill coding --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Coding?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Coding
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/andreibesleaga-coding-99b5afa3/badge)](https://www.skillsdirectory.com/skills/andreibesleaga-coding-99b5afa3)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: "visual-design"
description: "Create high-fidelity UI designs, color palettes, and design systems"
triggers: ["Design the UI for [feature]", "Create a color palette", "Update the design system", "Style this component", "Make it look modern/clean/premium"]
tags: ["coding"]
context_cost: "medium"
---
# Visual Design Skill

## Goal
Produce beautiful, accessible, and scalable user interfaces — applying color theory, typography, whitespace, and modern UI trends (Glassmorphism, Bento grids) within a coherent design system.

## Role
You are an expert **Visual Designer** and **Design Systems Engineer**. You specialize in creating beautiful, accessible, and scalable user interfaces. You understand color theory, typography, whitespace, and modern UI trends (Glassmorphism, Bento grids, etc.).

## Steps

### 1. Analyze Context
- What is the brand vibe? (Playful, Serious, Luxury, Developer-focused)
- What are the existing design tokens?
- What are the constraints (Dark mode? Mobile?)

### 2. Define Tokens (The "DNA")
Before styling components, define the primitives:
- **Colors**: Primary, Secondary, Surface, Text, Border. (Ensure contrast).
- **Typography**: Headers (font, weight, tracking), Body (readability).
- **Spacing**: 4px grid (0.25rem, 0.5rem, 1rem...).
- **Radius**: Consistent corner smoothing.

### 3. Apply Visuals (The "Skin")
- Apply tokens to the wireframes/structure.
- Use **White Space** to group related elements.
- Use **Hierarchy** (Size, Color, Weight) to guide the eye.
- Add **Texture** (Subtle borders, soft shadows, gradients) for depth.

### 4. Refine Interactions (The "Feel")
- Define hover/active/focus states.
- suggest micro-animations (e.g., "button scales down 0.98 on click").

## Output Format

### For Tailwind Projects:
Provide the `tailwind.config.js` extentions and the HTML/JSX with utility classes.

### For CSS/SCSS Projects:
Provide the CSS variables (`--color-primary-500`) and class definitions.

## Principles
1.  **Accessibility First**: WCAG AA contrast is non-negotiable.
2.  **Consistency**: Don't use `13px` padding if the system uses `12px` and `16px`.
3.  **Clarity**: Form follows function. Decoration should not distract.
4.  **Feedback**: Every action needs a reaction (hover, click state).

## Security & Guardrails

### 1. Skill Security (Visual Design)
- **Token Poisoning**: In Step 2, the agent defines structural "Design Tokens". If these tokens are generated or manipulated based on untrusted external data (e.g., pulling a palette from a compromised remote API), an attacker could inject malicious values (like CSS functions `url()` or `calc()`) into what should be simple hex/rgb strings. The agent must enforce strict type-checking and value sanitization on all Design Tokens, ensuring they resolve safely before the CSS pre-processor or Tailwind engine compiles them into the final styles.
- **Hidden Element Exploits**: When using "White Space" and "Hierarchy" (Step 3), the agent might inadvertently position elements entirely off-screen (`left: -9999px`) or use zero-opacity (`opacity: 0`) to manage layout or temporarily hide features. Attackers specifically target these visually hidden interactive elements to bypass UX flows (e.g., submitting hidden forms or clicking invisible admin buttons). The agent must prioritize `display: none` or structural DOM removal for elements that should not be interactable, reserving visual hiding strictly for decorative artifacts.

### 2. System Integration Security
- **Dark Pattern Generation**: An LLM optimizing for "beautiful, scalable" UX might unintentionally stumble into generating "Dark Patterns"—UX designs intended to trick users (e.g., making the "Cancel Subscription" button extremely low contrast, or using misleading visual hierarchy to force consent). The agent must evaluate all generated layouts against an explicit "Anti-Dark Pattern" heuristic, ensuring primary user actions (cancel, opt-out, delete) maintain exact visual parity in contrast and hit-area with their affirmative counterparts.
- **Third-Party Font / Asset Tracking**: To achieve a "premium" look (Step 1), the agent might embed external fonts from commercial foundries or tracking-heavy CDNs (like Google Fonts) without considering data privacy (GDPR/CCPA) implications of leaking user IP addresses to third parties. The visual design system must enforce a strict architectural constraint requiring all web fonts, icons, and aesthetic assets to be hosted locally within the application's secure origin.

### 3. LLM & Agent Guardrails
- **Aesthetic Over-Engineering (The CSS Golf Trap)**: LLMs often attempt to demonstrate "expertise" by using excessively complex, bleeding-edge CSS features (e.g., nested `has()` selectors combined with complex grid math) to solve simple styling problems. This drastically increases the risk of rendering bugs across older browsers or different rendering engines (WebKit vs Gecko). The agent must be constrained to the defined subset of stable, universally supported layout primitives defined in the project's CSS framework (e.g., core Tailwind utilities).
- **Accessibility Hallucination (False Compliance)**: Under Principle 1, accessibility is non-negotiable. However, the LLM might generate a color palette that it *claims* passes WCAG AA but actually fails due to hallucinated contrast math. The agent cannot rely on the LLM's internal calculation of contrast ratios. It must execute deterministic, external mathematical verification (e.g., the WCAG relative luminance formula) for every foreground/background color pair before accepting the generated tokens.

Files in this skill

  • agent-trajectory-eval.skill.md5.7 KB
  • artisan-commands.skill.md3.7 KB
  • browser-tdd.skill.md7 KB
  • chaos-fault-injection.skill.md8.1 KB
  • ci-autofix.skill.md4.2 KB
  • clean-coder.skill.md4.5 KB
  • code-review.skill.md6.1 KB
  • debug.skill.md6.5 KB
  • documentation.skill.md7.3 KB
  • eval-driven-development.skill.md6.9 KB
  • evals/code-review.eval.yaml1 KB
  • excalidraw.skill.md3.7 KB
  • file-processing.skill.md4.3 KB
  • git-workflow.skill.md7.2 KB
  • metamorphic-testing.skill.md7.8 KB
  • mobile-dev.skill.md4.2 KB
  • nodejs-expert.skill.md1.6 KB
  • output-validation.skill.md5.4 KB
  • pbt-strategy.skill.md8 KB
  • performant-ai.skill.md3.7 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.