Hallmark is a design skill that refuses to look AI-generated. When your agent builds a page, Hallmark deals three themes from a catalogue of fifty, each a complete material of paper, type, colour and components, then lays out the page around what the visitor came to do: a booking page books, a shop sells. It builds the hero first, reviews it cold, and finishes by linting the page in a real browser at eight widths against the tells that read as machine-made, such as an eyebrow label over every heading or one coloured word in the headline.
It is made by Together AI and has about 46,000 stars since its April 2026 start. It can also redesign an existing page while keeping every link, field and handler (it checks that none went missing), or just audit one. Real photographs come from 755 openly licensed Wikimedia Commons images, credited on the page. It credits Impeccable and Taste Skill, both on this list, as inspirations: Impeccable is the quick vocabulary you use all through a project, Hallmark the full build with a hard quality floor.
- Repository: github.com/Nutlope/hallmark
- Licence: MIT (MIT License)
- Language: CSS. Stars: 46.3K. Forks: 2,454. Last push: Oct 29, 2026.
- Scan: safe, Nov 3, 2026, commit 4f6a46c
Who it is for
Developers and indie makers who build landing pages with an agent and keep getting the same purple gradient, designers who review agent output, and anyone redesigning an old site without breaking it.
Getting started
1. Install for every project (Node 18 or later)
npx skills add nutlope/hallmark -g2. Optional: the browser checks need puppeteer-core and Chrome
npm i -g puppeteer-core3. Then ask for a page, or redesign or audit one
/hallmark audit ./index.htmlWithout puppeteer-core the static checks still run. The optional image generation script uses Together AI's API and only runs if you set your own TOGETHER_API_KEY.
Safety scan
We cloned Nutlope/hallmark at commit 4f6a46c on Nov 3, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits in 845 files and 63,000 lines of CSS, HTML, JavaScript and Markdown. No binaries committed.
- As a skill repo it got the extra pass: no hidden Unicode in the instructions (the one zero-width joiner sits inside an emoji-matching regex in the linter), no injection phrases, no exfiltration hosts and no credential paths.
- The only hook is opt-in. install-hook.mjs adds an edit-time check to Claude Code's settings only when you run it, refuses to overwrite a settings file it cannot parse, and runs a local lint script; nothing installs it for you.
- One workflow with no third-party actions. A licence is present; no Dependabot or security policy, but there are no lockfiles to update.
- Network hosts are upload.wikimedia.org for the photographs, api.together.xyz for the optional image script, and model APIs used only by the evaluation scripts in eval/, which you never run as a user.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. No third-party actions. |
| Network hosts | 7 distinct hosts referenced from source; most often api.anthropic.com, api.together.xyz, api.z.ai, api.moonshot.ai. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
By the numbers
| Stars | 46.3K |
|---|---|
| Forks | 2,454 |
| Contributors | 7 |
| Commits | 310 |
| Open issues | 26 |
| Open pull requests | 51 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | MIT |
| Main language | CSS |
| Project age | 6 months |
| Last push | Oct 29, 2026 |
| Tracked files | 845 |
| Lines of code | 63K |
| Checkout size | 66 MB |
Lines by language: CSS 19.2K, HTML 19K, JavaScript 12.5K, Markdown 8,333, JSON 2,711, Python 1,108.
Questions
Is Hallmark free?
Yes, MIT-licensed with no paid tier. Your only cost is the tokens your coding agent spends on the build, plus Together AI usage if you choose the optional image script.
Hallmark or Impeccable?
Impeccable is short commands like polish and critique that you use throughout a project. Hallmark is a full page build with themes, a hard quality floor and a browser check. They install side by side.
Will it change my existing site?
Only when you name it. A redesign keeps the content and wiring and fails if any link, field or handler went missing; say keep the layout for a restyle, or use audit to get a report and change nothing.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.