baoyu-design

Least-privilege permissions

• Restrict file access: Configure the skill to only read and write to a dedicated project folder; block access to sensitive directories like passwords, financial data, or employee records.
• Use read-only mode when possible: If you're only reviewing designs, disable the skill's ability to save files to your computer.
• Separate user accounts: Run the skill under a limited user account rather than administrator-level access; this prevents accidental damage if something goes wrong.

Network isolation

• Disable cloud sync: Ensure design prompts and generated HTML files are not automatically uploaded to cloud services or external servers.
• Block outbound connections: If your IT team manages your network, request that the skill be restricted from sending data outside your organization's network.
• Avoid public networks: Only use this skill on trusted, corporate networks; never on public WiFi or shared devices where others could intercept your design work.

Monitoring

• Review generated files before opening: Always inspect the HTML code in a text editor before viewing it in a browser; look for suspicious script tags or external links.
• Keep an audit log: Maintain a simple record of which designs were created and when, in case you need to investigate unexpected changes.
• Check local storage: Periodically verify that old design files are being deleted as expected and not accumulating unintended copies on your hard drive.

Red flags to watch for

• Unsolicited scripts or links in designs: If generated HTML contains code that tries to collect data, redirect you to websites, or pop up unexpected windows, stop using that design immediately.
• Designs that request credentials: Never enter passwords or sensitive information into design prompts; the skill should never ask for login details or personal data.
• Unexplained file changes: If files outside your design folder are modified, or if you see new files created without your request, report it to your IT team right away.