external/tgd-skills/tgd-sketch/SKILL.md
Throwaway HTML mockups: 2-3 design variants to compare.
npx skillsauth add seikaikyo/dash-skills tgd-sketchInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Generate 2-3 disposable HTML mockups to compare design directions before committing to implementation. Each variant is a self-contained HTML file with realistic content, inline CSS, and basic interactivity. The goal is visual comparison, not production code.
Use this skill when the user wants to see a design direction before committing to one — exploring a UI/UX idea as disposable HTML mockups. The point is to generate 2-3 interactive variants so the user can compare visual directions side-by-side, not to produce shippable code.
Trigger phrases: "sketch this screen", "show me what X could look like", "compare layout A vs B", "give me 2-3 takes on this UI", "let me see some variants", "mockup this before I build".
claude-design or build it properlyclaude-designexcalidraw, architecture-diagram/tgd-define's UI Design Gate): save variants to $TGD_DIR/<feature-name>/prototype/ — this is the directory the define/plan verification gates check. Name the three variants after the mandated stances: conservative/, strong-fit/, divergent/ (see tgd-spec-driven-development Phase 1.5).Outside the tGD lifecycle only: if gsd-sketch is installed (npx get-shit-done-cc), it offers persistent sketch state, MANIFEST, and consistency audits. Inside /tgd-define, always use THIS skill — the gates check $TGD_DIR/<feature-name>/prototype/, not GSD's .planning/sketches/.
intake → variants → head-to-head → pick winner (or iterate)
Before generating variants, get three things — one question at a time, not all at once:
Reflect each answer briefly before the next question. If the user already gave you all three upfront, skip straight to variants.
Produce 2-3 variants in one go. Each variant is a complete, standalone HTML file. Don't describe variants — build them. The point is comparison.
Each variant should take a different design stance, not different pixel values. Three good variant axes:
Pick one axis and pull apart from it. Two variants that differ only in accent color are wasted effort — the user can't distinguish them.
Variant naming: in the tGD lifecycle, use the mandated stance names; ad-hoc, describe the stance, not the number.
$TGD_DIR/<feature-name>/prototype/
├── conservative/
│ ├── index.html
│ └── README.md
├── strong-fit/
│ ├── index.html
│ └── README.md
└── divergent/
├── index.html
└── README.md
Each variant is a single self-contained HTML file:
<style> — no build step, no external CSS<link><script src="https://cdn.tailwindcss.com"></script>) is fineOpen it in a browser. If it looks broken, fix it before showing the user.
Verify variants visually — use the tgd-agent-browser skill (or your platform's browser tooling). Don't just write HTML and hope it renders; open each variant over file://, take a screenshot, and look at it. This catches layout bugs that pure source inspection misses (a font import that silently failed, a flex container that collapsed). Fix and re-check until each variant looks right.
Default CSS reset + system font stack for fast starts:
<style>
* { box-sizing: border-box; margin: 0; padding: 0; }
body {
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
"Helvetica Neue", Arial, sans-serif;
-webkit-font-smoothing: antialiased;
color: #1a1a1a;
background: #fafafa;
line-height: 1.5;
}
</style>
Each variant's README.md answers:
## Variant: {stance name}
### Design stance
One sentence on the principle driving this variant.
### Key choices
- Layout: ...
- Typography: ...
- Color: ...
- Interaction: ...
### Trade-offs
- Strong at: ...
- Weak at: ...
### Best for
- The kind of user or use case this variant actually serves
After all variants are built, present them as a comparison. Don't just list — opinionate:
## Three takes on the home screen
| Dimension | Calm editorial | Utilitarian dense | Playful split |
|-----------|----------------|-------------------|---------------|
| Density | Low | High | Medium |
| Primary action visibility | Low | High | Medium |
| Scan-ability | High | Medium | Low |
| Feel | Calm, trusted | Sharp, tool-like | Inviting, energetic |
**My take:** Utilitarian dense for power users, calm editorial for content-forward audiences. Playful split is weakest — tries to do both and commits to neither.
Let the user pick a winner, or combine two into a hybrid, or ask for another round.
If the user has an existing theme (colors, fonts, tokens), put shared tokens in prototype/themes/tokens.css and @import them in each variant. Keep tokens minimal:
/* prototype/themes/tokens.css */
:root {
--color-bg: #fafafa;
--color-fg: #1a1a1a;
--color-accent: #0066ff;
--color-muted: #666;
--radius: 8px;
--font-display: "Inter", sans-serif;
--font-body: -apple-system, BlinkMacSystemFont, sans-serif;
}
Don't over-tokenize a throwaway sketch — three colors and one font is usually enough.
A sketch is interactive enough when the user can:
More than that is over-engineering a throwaway. Less than that is a screenshot.
If sketches already exist and the user says "what should I sketch next?":
Propose 2-4 named candidates. Let the user pick.
$TGD_DIR/<feature-name>/prototype/ (see "Where variants live" above). Ad-hoc: the location the user chose — never the code repo root.<stance>/index.html + README.mdopen .../prototype/conservative/index.html on macOS, xdg-open on Linux, start on WindowsTypical sequence for one variant: create the variant directory, write index.html and README.md, open the file in a browser via the tgd-agent-browser skill, screenshot, fix anything visibly broken. Repeat for each variant, then present the comparison table.
Adapted from the GSD (Get Shit Done) project's /gsd-sketch workflow — MIT © 2025 Lex Christopherson (gsd-build/get-shit-done). The full GSD system ships persistent sketch state, theme/variant pattern references, and consistency-audit workflows; install with npx get-shit-done-cc --hermes --global.
tools
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
tools
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
development
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
testing
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.