Borrowing it
Nothing to install: this file belongs to kwakseongjae/oh-my-design. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kwakseongjae/oh-my-design/main/.claude/skills/omd-asset-fetch/SKILL.mdgit clone --depth 1 https://github.com/kwakseongjae/oh-my-designWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kwakseongjae/oh-my-design/omd-asset-fetch)<a href="https://agentmods.dev/skills/kwakseongjae/oh-my-design/omd-asset-fetch"><img src="https://agentmods.dev/badge/skills/kwakseongjae/oh-my-design/omd-asset-fetch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kwakseongjae/oh-my-design/omd-asset-fetch"><img src="https://agentmods.dev/badge/skills/kwakseongjae/oh-my-design/omd-asset-fetch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 7 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 5 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium Data Exfiltration · line 71 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 72 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 73 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 74 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 75 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- medium Data Exfiltration · line 172 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.03386 |
| Opus 5 | $0.00059 | $0.01693 |
| Sonnet 5 | $0.00024 | $0.00677 |
| Haiku 4.5 | $0.00012 | $0.00339 |
Grade A, and why
omd:asset-fetch scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
omd:asset-fetch — Free-license Asset Catalog
왜 이 스킬
"초안 같음" 결과물의 90%는 placeholder가 너무 generic이라서 — [YOUR LOGO] 점선 박스, organic blob SVG, "image placeholder" 회색 사각형. 사용자가 "와우" 못 느낌.
이 스킬은 모든 placeholder 자리에 verified free-license CDN 자산을 박는 catalog. URL은 전부 200 OK 검증됨 (2026-05-14 기준).
핵심 원칙
- 검증된 URL만. 이 catalog에 없으면 generator가 임의로 만들지 말 것.
- 모든 자산은 commercial-use 허용 — 사용자 product에 ship 가능.
- 출처는
assets/attribution.md에 의무 기록 — URL + license + 사용 위치 + fetch 일자. - deterministic seeding 권장 —
seed또는lock파라미터로 결과 재현 가능. 매번 다른 이미지 나오는 random URL은 피할 것. - 금지: handcraft inline SVG로 placeholder를 "그려서" 채우기. catalog 자산 fetch 실패 시 → brand-color CSS gradient placeholder (이전 v1.3.4 fallback 정책과 동일).
Catalog (verified 2026-05-14)
1. LOGO — product name 워드마크만 (v1.3.7부터)
별도 icon / shapes mark / DiceBear logo 합성 금지. 헤더 logo = product name 텍스트 + 디스플레이 폰트, 그게 전부.
왜: AI가 합성한 icon mark는 "generic"하게 보임 (사용자 frustration source). product 이름을 꽤 괜찮은 폰트로 그대로 박는 게 진짜 brand wordmark처럼 보이고 사용자가 1초만에 자기 product name으로 swap 가능.
패턴:
<a class="logo" href="/" style="display:inline-flex;align-items:center;text-decoration:none;">
<span class="logo-wordmark">{{PRODUCT_NAME}}</span>
</a>
<style>
.logo-wordmark{
font-family:"Bricolage Grotesque","Space Grotesk","DM Serif Display","Fraunces",-apple-system,sans-serif;
font-size:22px;font-weight:700;letter-spacing:-0.04em;
color:var(--color-text-heading);
}
</style>
<head>에 디스플레이 폰트 <link> 의무 (§6 참고).
brand vibe별 폰트 매칭:
- cool / minimal / fintech serious → Space Grotesk 700 (geometric)
- warm / playful / community → Bricolage Grotesque 700 (friendly variable)
- editorial / luxury → DM Serif Display 또는 Fraunces (display serif)
- bold / display → Bricolage Grotesque 800
{{PRODUCT_NAME}} 결정:
- 사용자 prompt에 명시 product name 있으면 그대로 사용
- 없으면 brand vibe 맞는 generic placeholder 1개 선택 (omd-harness rule 5 §placeholder 표 참고:
Folio,Mint,Pop,Spark,Townie,Lane,Compass, ...) - 선택된 이름은
<title>, hero copy, footer brand 자리 전부 일관 적용 (사용자 grep replace 1번이면 swap 끝)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 216 lines · 118 tokens per session scan A 79645af74833
omd:asset-fetch is a skill published in the GitHub repository kwakseongjae/oh-my-design (500 stars, last pushed 5d ago), licensed MIT. It adds 118 tokens to every session and 3,386 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dembrandt
A TypeScript command-line tool that renders a web page with Playwright and examines its actual styles. It turns colours, typography, spacing, borders, shadows, animation curves, components, and breakpoints into structured design tokens.
extract-design
Extract the full design language from any website URL. Produces 8 output files including AI-optimized markdown, visual HTML preview, Tailwind config, React theme, shadcn/ui theme, Figma variables, W3C design tokens, and CSS variables. Also runs WCAG accessibility scoring. Use when user says 'extract design', 'get…
designlang-tokens
Use when styling UI for cal.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.
brandmd
Extract a website's design system into a DESIGN.md file. Use when starting a new frontend project, rebuilding a site, or when the user wants AI-generated UI to match an existing brand.
montology
A repo's vocabulary as a database, enforced against the code by a tree-sitter scan — in every language it declares (Python, TypeScript/JS, Go, Rust, Swift, Java, Ruby, Elixir, C/C++, and more). Use BEFORE naming anything in code — a class, struct, function, type, module, table, column, endpoint, event, env var, CLI…
design-engineering
Premium design engineering skill for agentic workflows — produces high-end, distinctive UI designs using DESIGN.md as the portable contract across Pencil MCP (in-IDE canvas), Figma MCP (team handoff + design tokens), and Google Stitch (vibe exploration + AI generation). Enforces anti-generic principles, WCAG 2.2 AA…