Impeccable gives your coding agent a design vocabulary. After one install it understands commands such as polish and bolder, which steer a design, and critique and audit, which review one and catch AI slop before it ships. When a new design starts, the skill fetches a set of visual directions from the impeccable.style catalog, so the agent commits to a direction instead of defaulting to the same gradient hero. It works with Claude Code, Cursor, Codex CLI, GitHub Copilot, Devin and Replit Agent.
It is by Paul Bakaus, the original author of jQuery UI, and has about 98,000 stars a year after its November 2025 start, with 62 contributors and a CLI released weekly. The CLI is Rust, the skill content is JavaScript and Markdown, and the whole thing is Apache-2.0. Where Taste Skill on this list runs a 45-minute build with photographs and browser checks, Impeccable is the lighter tool you keep using throughout a project.
One thing to know up front: it has telemetry. The README states that it keeps an anonymous record of which design direction you picked and shows how to turn that off; the catalog fetch when a design starts stays either way.
- Repository: github.com/pbakaus/impeccable
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Rust. Stars: 98.3K. Forks: 5,796. Last push: Oct 31, 2026.
- Scan: safe, Nov 1, 2026, commit 4f95649
Who it is for
Developers who use an agent for front-end work and want a quick word to nudge it, designers reviewing agent output, and indie makers shipping landing pages without a designer.
Getting started
1. Install from your project root (Node required)
npx impeccable install2. Reload your coding tool, then initialise inside the agent ($impeccable init on Codex)
/impeccable init3. Then steer and review with the vocabulary
polish, bolder, critique, auditThe install adds the skill to the agents it finds on your machine. Read the README's telemetry section and switch it off if you prefer; the design directions still load.
Safety scan
We cloned pbakaus/impeccable at commit 4f95649 on Nov 1, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits in 4,441 files and 870,000 lines: 390,000 of JavaScript, 260,000 of Rust and 146,000 of Markdown. No binaries committed.
- Two build-time hooks: a prepack npm script that swaps the README for the npm one, and a build.rs in crates/html that generates the CSS cascade tables when the Rust crate compiles. Build scripts run code at compile time, so read it if you build from source; the npm package ships prebuilt.
- Cargo.lock has 209 crates with 12 advisories: two critical and two high, all in zip 2.4.2 (a parser differential, permissions applied through symlinks, unbounded symlink targets and SUID bits preserved on extraction), one moderate in rustls 0.23.45 (debug formatting that can expose TLS secrets), and the rest low or unrated. They matter when extracting untrusted archives, which is not what the CLI does with your files, but they are real and should be bumped.
- Four workflows, none using pull_request_target, and all 21 third-party action uses pinned to commits. Dependabot and a licence are present; no security policy or CodeQL.
- Network hosts in the code are github.com, impeccable.style (the catalog and the telemetry endpoint), fonts.googleapis.com and otherwise example and test hosts. The telemetry is described in the README with an opt-out, so it does not contradict what the project tells you.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script. 1 Cargo build script |
| Committed binaries | None. |
| CI workflows | 4 workflows. None use pull_request_target. 0 of 21 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, impeccable.style, cards.test, x.test. No URLs to bare IP addresses. |
| Known vulnerabilities | 12 advisories across 209 pinned packages: 2 critical, 2 high, 2 moderate, 3 low, 3 unrated. Cargo.lock: 209 packages, 12 advisories. |
| Project hygiene | Has automated dependency updates, licence file. Missing security policy, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
npm lifecycle scripts (1)
package.jsonprepack:cp README.md README.repo.md && cp README.npm.md README.md
Worst known vulnerabilities (12 of 12)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-m665-v7pm-7grj | critical | zip@2.4.2 | zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Ar… |
| GHSA-4684-h2q9-2vcp | critical | zip@2.4.2 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targe… |
| GHSA-q7v9-x93c-xqv3 | high | zip@2.4.2 | zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction |
| GHSA-vv5m-jxxh-4627 | high | zip@2.4.2 | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation |
| GHSA-c8m5-c952-6cm4 | moderate | rustls@0.23.45 | Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs |
| GHSA-8hxf-qr8p-62x4 | moderate | zip@2.4.2 | zip: AES Entry HMAC Authentication Bypass on Premature EOF |
| GHSA-h2v8-394m-p7vv | low | rustls@0.23.45 | Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authent… |
| GHSA-vp88-798v-h67f | low | rustls@0.23.45 | rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert |
| GHSA-w44r-93j7-qv28 | low | rustls@0.23.45 | rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a clas… |
| CVE-2026-111943 | unknown | rustls-webpki@0.103.15 | Certificate verification may accept distrusted intermediates |
| CVE-2026-111943 | unknown | webpki-roots@1.0.9 | Bundled root certificates allow trust in distrusted emSign intermediates |
| GHSA-4v9h-p7m9-rh26 | unknown | zip@2.4.2 | zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination director… |
By the numbers
| Stars | 98.3K |
|---|---|
| Forks | 5,796 |
| Contributors | 62 |
| Commits | 2,610 |
| Open issues | 40 |
| Open pull requests | 23 |
| Releases | 93 |
| Latest release | cli-v4.8.0 |
| Licence | Apache-2.0 |
| Main language | Rust |
| Project age | 11 months |
| Last push | Oct 31, 2026 |
| Tracked files | 4,441 |
| Lines of code | 870.5K |
| Checkout size | 87 MB |
Lines by language: JavaScript 389.6K, Rust 259.7K, Markdown 146.2K, HTML 29.4K, JSON 29K, Batch 7,061.
Questions
Is Impeccable free?
Yes, Apache-2.0 with no paid tier. The design catalog it fetches is free too. Your only cost is the tokens your coding agent spends following the skill.
Does Impeccable send data anywhere?
When a new design starts it fetches visual directions from impeccable.style. Separately it records, anonymously, which direction was picked; the README shows how to turn that off, and turning it off does not stop the catalog request.
Impeccable or Taste Skill?
Impeccable is short commands you use all through a project. Taste Skill is a full build that deals directions, finds real photographs and checks the page in a browser, and takes most of an hour. They install side by side.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.