Taste Skill is an Agent Skill that changes how a coding agent designs a website or an app screen. Instead of assembling the average landing page, the agent reads the brief and lists what only this client has, a script deals it three of twenty researched design directions and it picks one, it finds a single idea that ties the client's material to that direction, builds the page with real photographs and footage from open collections, then checks the result in a real browser at three widths and fails it on slop. It looks at its own screenshots and fixes the top three problems, up to three rounds.
The skill is distilled from a study of 247 curated sites, and version 2.1 added a separate route for dashboards and app screens: a style dealt from real product screens, quiet panels, aligned figures, colour spent on data and a phone layout where the navigation folds away. It is by Leonxlnx, MIT licensed, and went from a February 2026 launch to about 107,000 stars by November, the most-starred of the design skills that appeared this year alongside Impeccable and Hallmark.
It runs on Node 22 or newer with Chrome, Edge or Chromium installed, installs nothing else and needs no API keys; the only network use is finding pictures. A full build takes roughly 30 to 45 minutes and a few hundred thousand tokens, so it is for a page you care about, not a quick mock-up.
- Repository: github.com/Leonxlnx/taste-skill
- Licence: MIT (MIT License)
- Language: JavaScript. Stars: 107K. Forks: 7,242. Last push: Oct 31, 2026.
- Scan: safe, Nov 1, 2026, commit 12af471
Who it is for
Developers and founders who use a coding agent for front-end work and are tired of the same hero, three cards and a gradient, and designers who want the agent to argue from a direction rather than a template.
Getting started
1. Install the skill with the Skills CLI (Node 22+ and Chrome required)
npx skills add https://github.com/Leonxlnx/taste-skill --skill "design-taste-frontend"2. Or add it as a Claude Code plugin, inside Claude Code
/plugin marketplace add Leonxlnx/taste-skill3. Then install the plugin
/plugin install taste-skill@taste-skill4. Codex users add the marketplace the same way
codex plugin marketplace add Leonxlnx/taste-skillGive it a real brief with the client's own material. The pictures it picks are public domain or Creative Commons and it puts the credits on the page; swap in your own when you have them.
Safety scan
We cloned Leonxlnx/taste-skill at commit 12af471 on Nov 1, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits in 72 files and 38,236 lines, most of them JSON: the research study and the design directions the skill deals from, plus the Markdown instructions and the JavaScript that drives the browser checks.
- One installer, install.sh at 136 lines, which symlinks the skill into Claude Code or Codex so a git pull updates it in place. No sudo, no shell profile edits, nothing piped from the internet into a shell.
- Every host the code reaches is a picture source: Wikimedia and archive.org, Openverse, the Met and the Art Institute of Chicago collection APIs, NASA's image API and creativecommons.org for the licence links. No analytics, no telemetry.
- One workflow with no third-party actions. No lockfiles, so there were no dependencies to query for advisories. A licence is present; there is no security policy or contributing guide, which is normal for a skill repository.
- The README states that the project has no token, coin or crypto project and disowns any that use its name. We looked because a few popular agent repositories have been used that way; this one is clear.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | 1 workflow. None use pull_request_target. No third-party actions. |
| Network hosts | 16 distinct hosts referenced from source; most often creativecommons.org, archive.org, cdn.jsdelivr.net, www.artic.edu. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- install.sh, 136 lines
By the numbers
| Stars | 107K |
|---|---|
| Forks | 7,242 |
| Contributors | 24 |
| Commits | 254 |
| Open issues | 6 |
| Open pull requests | 2 |
| Releases | 7 |
| Latest release | v2.1.5 |
| Licence | MIT |
| Main language | JavaScript |
| Project age | 8 months |
| Last push | Oct 31, 2026 |
| Tracked files | 72 |
| Lines of code | 38.2K |
| Checkout size | 3 MB |
Lines by language: JSON 27.3K, Markdown 5,772, JavaScript 4,672, CSS 352, Shell 136, YAML 28.
Questions
Is Taste Skill free?
Yes. It is MIT licensed and installs nothing paid. The cost is your coding agent's tokens: a full build is a few hundred thousand of them, which on a metered API plan is real money, so run it on pages that matter.
Which coding agents does Taste Skill work with?
Claude Code and Codex have plugin installs, and the Skills CLI puts it in front of Cursor and any other agent that reads Agent Skills. The rules are about design, not a framework, so React, Vue, Svelte and plain HTML all work.
Can I use the photographs it picks?
They come from open collections such as Wikimedia Commons, Openverse and the Met, and the skill only offers public domain, CC0, CC BY and CC BY-SA files, with credits placed on the page. Replace them with your own photography when you have it.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.