{"data":{"skill":{"slug":"tencentcloudbase-ui-design","name":"ui-design","icon":"📦","repo":"https://github.com/tencentcloudbase/skills/tree/main/skills/ui-design","status":"approved","author":"tencentcloudbase","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"5fd47aa6-5dd3-48a5-a2a1-8218e131ee44","skill_id":"e9b16015-1089-44a6-a27f-e9e628ebd88b","version":1,"content_hash":"v2:24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec:3199aa7cae815caec0d807aefffc58941eaba56b592df39cbfa48209ca48b5ad:78f27822523a3ff63e3102ca78b40c630706a50cb5e15df0c784803808f05378:ddfd7e04557c3ff2d0a414f8c8869474","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All static findings are false positives. Backticks are Markdown, URLs are reference links, and relative paths point to sibling skill documents. No evidence found for prompt injection, data exfiltration, or malicious execution intent in SKILL.md.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":125,"line_start":114},{"file":"SKILL.md","line_end":235,"line_start":125},{"file":"SKILL.md","line_end":269,"line_start":235},{"file":"SKILL.md","line_end":299,"line_start":269},{"file":"SKILL.md","line_end":303,"line_start":299},{"file":"SKILL.md","line_end":306,"line_start":303},{"file":"SKILL.md","line_end":310,"line_start":306},{"file":"SKILL.md","line_end":313,"line_start":310},{"file":"SKILL.md","line_end":318,"line_start":313}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":32,"line_start":32}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":356,"audit_model":"codex","audited_at":"2026-07-09T16:56:06.632+00:00","created_at":"2026-07-09T17:30:25.010434+00:00","static_findings":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If this environment only installed the current skill, start from the CloudBase main entry and use th","category":"external_commands","line_end":10,"severity":"medium","line_start":10},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Keep local `references/...` paths for files that ship with the current skill directory. When this fi","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Web implementation -> `../web-development/SKILL.md` (standalone fallback: `https://cnb.cool/tencen","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Mini program implementation -> `../miniprogram-development/SKILL.md` (standalone fallback: `https:","category":"external_commands","line_end":32,"severity":"medium","line_start":32},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":125,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":235,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```tsx","category":"external_commands","line_end":269,"severity":"medium","line_start":235},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":299,"severity":"medium","line_start":269},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":303,"severity":"medium","line_start":299},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":306,"severity":"medium","line_start":303},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":310,"severity":"medium","line_start":306},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":313,"severity":"medium","line_start":310},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":318,"severity":"medium","line_start":313},{"id":"network:SKILL.md:12:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk","category":"network","line_end":12,"severity":"low","line_start":12},{"id":"network:SKILL.md:13:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai","category":"network","line_end":13,"severity":"low","line_start":13},{"id":"network:SKILL.md:31:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Web implementation -> `../web-development/SKILL.md` (standalone fallback: `https://cnb.cool/tencen","category":"network","line_end":31,"severity":"low","line_start":31},{"id":"network:SKILL.md:32:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"- Mini program implementation -> `../miniprogram-development/SKILL.md` (standalone fallback: `https:","category":"network","line_end":32,"severity":"low","line_start":32},{"id":"filesystem:SKILL.md:31:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Web implementation -> `../web-development/SKILL.md` (standalone fallback: `https://cnb.cool/tencen","category":"filesystem","line_end":31,"severity":"high","line_start":31},{"id":"filesystem:SKILL.md:32:path-traversal-sequence","file":"SKILL.md","pattern":"Path traversal sequence","snippet":"- Mini program implementation -> `../miniprogram-development/SKILL.md` (standalone fallback: `https:","category":"filesystem","line_end":32,"severity":"high","line_start":32},{"id":"blocker:SKILL.md:84:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"3. **Avoid Generic AI Aesthetics**","category":"blocker","line_end":84,"severity":"low","line_start":84},{"id":"blocker:SKILL.md:124:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"❌ FORBIDDEN: Standard centered layouts, simple grid without creative breaking","category":"blocker","line_end":124,"severity":"low","line_start":124},{"id":"blocker:SKILL.md:143:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Education apps**: Editorial/Organic/Retro-futuristic (avoid generic blue)","category":"blocker","line_end":143,"severity":"low","line_start":143},{"id":"blocker:SKILL.md:167:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"4. **High-Fidelity UI Design**: As a UI designer, design interfaces that align with real iOS/Android","category":"blocker","line_end":167,"severity":"low","line_start":167},{"id":"blocker:SKILL.md:178:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Avoid Generic Fonts**: Do not use overly common fonts like Arial, Inter, Roboto, system fonts","category":"blocker","line_end":178,"severity":"low","line_start":178},{"id":"blocker:SKILL.md:213:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Atmosphere Creation**: Create atmosphere and depth rather than defaulting to solid colors","category":"blocker","line_end":213,"severity":"low","line_start":213},{"id":"blocker:SKILL.md:225:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"### Avoid Generic AI Aesthetics","category":"blocker","line_end":225,"severity":"low","line_start":225},{"id":"blocker:SKILL.md:250:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"<div className=\"grid grid-cols-12 min-h-screen\">","category":"blocker","line_end":250,"severity":"low","line_start":250},{"id":"blocker:SKILL.md:273:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Avoid Repetition**: Each design should be different, vary between generations:","category":"blocker","line_end":273,"severity":"low","line_start":273},{"id":"blocker:SKILL.md:277:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- **Avoid Convergence**: Never converge on common choices (e.g., Space Grotesk)","category":"blocker","line_end":277,"severity":"low","line_start":277},{"id":"blocker:SKILL.md:326:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Did you output the DESIGN SPECIFICATION before code? (Required: YES)","category":"blocker","line_end":326,"severity":"low","line_start":326}],"finding_verdicts":[{"id":"external_commands:SKILL.md:10:ruby-shell-backtick-execution","reason":"This is inline Markdown prose that names published skill paths or source URLs. It does not invoke a shell, interpolate input, or execute code.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"This is inline Markdown prose that names published skill paths or source URLs. It does not invoke a shell, interpolate input, or execute code.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"This is inline Markdown prose that names published skill paths or source URLs. It does not invoke a shell, interpolate input, or execute code.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"This is inline Markdown prose that names published skill paths or source URLs. It does not invoke a shell, interpolate input, or execute code.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"This line is a Markdown reference to a sibling skill document and fallback URL. It contains no command execution or user-controlled shell input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:32:ruby-shell-backtick-execution","reason":"This line is a Markdown reference to a sibling skill document and fallback URL. It contains no command execution or user-controlled shell input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"The finding points to Markdown code fences and UI design examples. The text is instructional content, not shell execution or dynamic code evaluation.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"This is inline Markdown prose that names published skill paths or source URLs. It does not invoke a shell, interpolate input, or execute code.","verdict":"false_positive","confidence":0.94},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"The finding points to Markdown code fences and UI design examples. The text is instructional content, not shell execution or dynamic code evaluation.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:269:ruby-shell-backtick-execution","reason":"The finding points to Markdown code fences and UI design examples. The text is instructional content, not shell execution or dynamic code evaluation.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:299:ruby-shell-backtick-execution","reason":"The bash blocks show local grep self-audit examples for generated UI files. They do not run automatically, fetch data, or include unsafe interpolation.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:303:ruby-shell-backtick-execution","reason":"The bash blocks show local grep self-audit examples for generated UI files. They do not run automatically, fetch data, or include unsafe interpolation.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","reason":"The bash blocks show local grep self-audit examples for generated UI files. They do not run automatically, fetch data, or include unsafe interpolation.","verdict":"false_positive","confidence":0.88},{"id":"external_commands:SKILL.md:310:ruby-shell-backtick-execution","reason":"This line is a Markdown reference to a sibling skill document and fallback URL. It contains no command execution or user-controlled shell input.","verdict":"false_positive","confidence":0.92},{"id":"external_commands:SKILL.md:313:ruby-shell-backtick-execution","reason":"This line is a Markdown reference to a sibling skill document and fallback URL. It contains no command execution or user-controlled shell input.","verdict":"false_positive","confidence":0.92},{"id":"network:SKILL.md:12:hardcoded-url","reason":"The URL is a documented source or fallback reference under the same CloudBase skill repository. No credential, telemetry, or data exfiltration behavior is present.","verdict":"false_positive","confidence":0.86},{"id":"network:SKILL.md:13:hardcoded-url","reason":"The URL is a documented source or fallback reference under the same CloudBase skill repository. No credential, telemetry, or data exfiltration behavior is present.","verdict":"false_positive","confidence":0.86},{"id":"network:SKILL.md:31:hardcoded-url","reason":"The URL is a documented source or fallback reference under the same CloudBase skill repository. No credential, telemetry, or data exfiltration behavior is present.","verdict":"false_positive","confidence":0.86},{"id":"network:SKILL.md:32:hardcoded-url","reason":"The URL is a documented source or fallback reference under the same CloudBase skill repository. No credential, telemetry, or data exfiltration behavior is present.","verdict":"false_positive","confidence":0.86},{"id":"filesystem:SKILL.md:31:path-traversal-sequence","reason":"The relative path is a hardcoded sibling skill reference, not a traversal operation over user input. It stays within the expected skill documentation layout.","verdict":"false_positive","confidence":0.93},{"id":"filesystem:SKILL.md:32:path-traversal-sequence","reason":"The relative path is a hardcoded sibling skill reference, not a traversal operation over user input. It stays within the expected skill documentation layout.","verdict":"false_positive","confidence":0.93},{"id":"blocker:SKILL.md:84:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:124:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:143:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:167:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:178:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:213:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:225:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:250:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:273:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:277:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97},{"id":"blocker:SKILL.md:326:system-reconnaissance","reason":"The line is a UI design guideline or checklist item. It does not probe the host system or request reconnaissance data.","verdict":"false_positive","confidence":0.97}],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}