Borrowing it
Nothing to install: this file belongs to kwakseongjae/oh-my-design. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kwakseongjae/oh-my-design/main/.claude/skills/omd-reference-capture/SKILL.mdgit clone --depth 1 https://github.com/kwakseongjae/oh-my-designWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kwakseongjae/oh-my-design/omd-reference-capture)<a href="https://agentmods.dev/skills/kwakseongjae/oh-my-design/omd-reference-capture"><img src="https://agentmods.dev/badge/skills/kwakseongjae/oh-my-design/omd-reference-capture/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kwakseongjae/oh-my-design/omd-reference-capture"><img src="https://agentmods.dev/badge/skills/kwakseongjae/oh-my-design/omd-reference-capture.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 5 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- medium Agent Snooping · line 65 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00160 | $0.08937 |
| Opus 5 | $0.00080 | $0.04469 |
| Sonnet 5 | $0.00032 | $0.01787 |
| Haiku 4.5 | $0.00016 | $0.00894 |
Grade A, and why
omd:reference-capture scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- 다운로드 전 `curl -sI <site>/robots.txt`로 기본 정책 확인. How it starts
The opening of the file, as written. The whole thing — 701 lines — stays where its author put it; the contents beside it link to each section on GitHub.
omd:reference-capture — Live Reference Capture
선택된 reference brand의 라이브 사이트에서 디자인 evidence를 가져온다.
산출물은 assets/_reference/<id>/ 디렉토리에 모이며 그 자체로 프로젝트
디자인 권한이 되지 않는다.
핵심 원칙 (위반 = regression)
이 스킬은 dev/디자인 reference 캡쳐용이다. brand IP를 사용자 product에 그대로 ship하는 도구가 아니다.
-
Evidence-only authority boundary
- 이 스킬은 root
DESIGN.md,.omd/system/graph.json, manifest 또는 project token을 쓰거나 수정하지 않는다. evidence.json,tokens.json,live_overrides,fonts.json, screenshots, logo는 관찰 evidence다. omd:apply/omd:harness가 자동 적용·동기화하거나 fallback으로 사용할 수 없다.- graph-authoring checkpoint가 source/provenance와 사용자 권한을 검토해
결정을 Core v2
graph.json에 명시적으로 admit하고,profile: portable-coremanifest가 graph와 DESIGN.md의 exact SHA-256을 검증할 때만 그 graph path가 프로젝트 authority가 된다. capture 파일 자체는 admission 뒤에도 evidence로 남는다. - exact Core stable anchor가 있는 reference는
experience,foundations,typography-assets,components-states,layout-platforms,content-locales,governance로 읽는다. anchor가 전혀 없는 reference만 legacy meaning-based fallback으로 읽고 숫자 section을 새 citation에 복사하지 않는다.
- 이 스킬은 root
-
Facts vs. Content 구분
- Facts (캡쳐 OK): 컴퓨티드 색상 hex, 폰트 family/weight, spacing, radius, 컴포넌트 구조 — 디자인 시스템 분석은 fair use.
- Brand content (저장만, 사용자 product에 verbatim ship 금지): 로고, 히어로 사진, 마케팅 카피, 슬로건. 다운로드는 reference 확인용으로만.
-
저작권 표시 의무
- 캡쳐 시작 전
assets/_reference/<id>/LICENSE-NOTE.md를 가장 먼저 작성. - 모든 다운로드 파일은
attribution.md에 source URL + 캡쳐 일자 + 추정 권리자 기록.
- 캡쳐 시작 전
-
사용자 product 생성 시 분리
- omd:apply/omd:harness는 capture의 brand voice/tone도 evidence로만 본다. 프로젝트에 적용하려면 먼저 Core graph admission이 필요하며 literal copy는 어떤 경우에도 새로 작성한다.
- brand 히어로 사진 / 마케팅 영상은 사용자 product에 직접 embed하지 말고 placeholder + "사용자 자체 자산으로 교체 필요" 주석.
-
robots.txt / TOS 우선
- 다운로드 전
curl -sI <site>/robots.txt로 기본 정책 확인. - 사이트가 명시적으로 차단하는 경로면 skip하고 사용자에게 알림.
- 다운로드 전
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 701 lines · 160 tokens per session scan A 3edb0aa23805
omd:reference-capture is a skill published in the GitHub repository kwakseongjae/oh-my-design (498 stars, last pushed 3d ago), licensed MIT. It adds 160 tokens to every session and 8,937 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dembrandt
A TypeScript command-line tool that renders a web page with Playwright and examines its actual styles. It turns colours, typography, spacing, borders, shadows, animation curves, components, and breakpoints into structured design tokens.
extract-design
Extract the full design language from any website URL. Produces 8 output files including AI-optimized markdown, visual HTML preview, Tailwind config, React theme, shadcn/ui theme, Figma variables, W3C design tokens, and CSS variables. Also runs WCAG accessibility scoring. Use when user says 'extract design', 'get…
designlang-tokens
Use when styling UI for cal.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.
montology
A repo's vocabulary as a database, enforced against the code by a tree-sitter scan — in every language it declares (Python, TypeScript/JS, Go, Rust, Swift, Java, Ruby, Elixir, C/C++, and more). Use BEFORE naming anything in code — a class, struct, function, type, module, table, column, endpoint, event, env var, CLI…
brandmd
Extract a website's design system into a DESIGN.md file. Use when starting a new frontend project, rebuilding a site, or when the user wants AI-generated UI to match an existing brand.
design-engineering
Premium design engineering skill for agentic workflows — produces high-end, distinctive UI designs using DESIGN.md as the portable contract across Pencil MCP (in-IDE canvas), Figma MCP (team handoff + design tokens), and Google Stitch (vibe exploration + AI generation). Enforces anti-generic principles, WCAG 2.2 AA…