Webflow

Build, launch, and optimize Webflow sites with responsive design, CMS architecture, and clean handoffs.

Security Scan

The skill's content matches its Webflow purpose, but it reads/writes a local memory file (~/webflow/memory.md) and references bearer tokens in examples without declaring config paths or credential needs — this mismatch warrants caution.

Purpose & Capability

Name, description, and included docs (design, CMS, integrations, optimization) are consistent. The guidance and examples are appropriate for a Webflow-focused skill and do not request unrelated cloud credentials or unrelated system tools.

Instruction Scope

SKILL.md instructs the agent to 'Read on activation' and to create ~/webflow and ~/webflow/memory.md for user preferences. Those file reads/writes are not declared in the registry metadata (required config paths = none). The skill also contains code examples that reference API/TOKEN constants; while expected for CMS/API usage, the runtime instructions do not explicitly define how tokens are supplied or protected.

Install Mechanism

No install spec and no code files beyond documentation — lowest-risk deployment model. Nothing is downloaded or written by an installer.

Credentials

Registry metadata declares no required env vars, yet cms.md shows use of a Bearer token (TOKEN) for Webflow API and examples reference API/TOKEN variables. The skill also implicitly accesses a local config path (~/webflow/memory.md) without declaring it. This mismatch between declared vs. implied credentials/config access is disproportionate and should be clarified.

Persistence & Privilege

The skill persists a memory file under the user's home directory and will create ~/webflow on first use. It is not set to always:true and does not request system-wide config changes or other skills' secrets, but the local persistence is non-trivial and should be disclosed/approved by the user.

What to consider before installing

This skill appears to be legitimate Webflow documentation and guidance, but it will create and read a local preferences file at ~/webflow/memory.md even though the registry metadata doesn't declare that config path. Before installing or enabling the skill: (1) confirm you are comfortable with it creating ~/webflow and storing preferences there; (2) do not paste API keys or bearer tokens into chat — instead provide them through a secure, deliberate mechanism if the agent asks; (3) review any webhook/third-party endpoint instructions before wiring live endpoints (they can send user data externally); and (4) ask the skill author or registry for clarification / to declare the config path and any expected credential inputs. If you need higher assurance, run the skill in a restricted environment or request the author add explicit declarations of required env vars and config paths.

Quick Reference

Topic	File
Responsive design, breakpoints	design.md
CMS collections, headless API	cms.md
Forms, analytics, third-party	integrations.md
SEO, performance, accessibility	optimization.md

Memory Storage

User preferences stored at ~/webflow/memory.md. Read on activation.

Format:

# Webflow Memory

## Profile
- role: freelancer | agency | founder | developer | marketer
- design-source: figma | sketch | from-scratch | template
- cms-needs: none | blog | multi-collection | headless

## Preferences
- class-naming: bem | utility | semantic
- breakpoints: mobile-first | desktop-first

Create folder on first use: mkdir -p ~/webflow

Critical Rules

1. Always check all breakpoints — Desktop looks great, mobile is broken. Test tablet/mobile-landscape/mobile-portrait BEFORE showing to client.

2. Name classes semantically — hero-heading not heading-23. You'll thank yourself during handoff.

3. Set up CMS before content — Define collections, fields, and relationships first. Migrating content between structures is painful.

4. Calculate TRUE hosting cost — Basic Hosting ≠ CMS Hosting ≠ Business Hosting. Forms, CMS items, staging all cost extra.

5. Test forms with real submissions — Webflow form notifications fail silently. Verify delivery before launch.

6. Never trust auto-generated responsive — Webflow guesses wrong. Manual breakpoint adjustment is mandatory.

7. Audit before publish — Missing alt text, 404s, broken links, favicon, OG image, SSL, redirects. Use pre-launch checklist every time.

8. Export code = cleanup required — Webflow's exported HTML/CSS is bloated. Budget time for cleanup if moving off platform.

Scope

This skill covers Webflow design, development, and project management. For general web design principles, see ui-design. For landing page conversion strategy, see landing-pages.