📦

oil-ui

Name: oil-ui
Author: oil-oil

v0.15.5 Inhaltsrevision r2 Hohes Risiko ⚡ Enthält Skripte⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen

Explore and Refine Interface Designs

Interface projects often need clear visual direction before implementation. Oil UI guides design exploration, preview comparison, and evidence-based refinement.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "oil-ui" from https://skillstore.io/skills/oil-oil-oil-ui.md and its manifest at https://skillstore.io/api/skills/oil-oil-oil-ui/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/oil-oil-oil-ui.md Signiertes manifest GET /api/skills/oil-oil-oil-ui/manifest Signiertes lockfile GET /api/skills/oil-oil-oil-ui/lockfile

Testen

„oil-ui“ wird verwendet. Compare three visual directions for a course booking interface.

Erwartetes Ergebnis:

A comparison page with three distinct compositions, documented palettes, typography choices, and desktop and mobile views.
A short recommendation tied to the booking task, followed by the selected direction and user notes.

„oil-ui“ wird verwendet. Review an existing interface without changing files.

Erwartetes Ergebnis:

The primary action competes with secondary navigation. Reduce secondary emphasis and align the action with the current task.
The mobile heading wraps poorly. Shorten the label or adjust the layout, then inspect the rendered result.
Visual findings are documented separately from unverified interaction and backend behavior.

„oil-ui“ wird verwendet. Capture evidence for an interactive prototype.

Erwartetes Ergebnis:

Desktop and mobile screenshots, a text-masked comparison, motion frames, and a report listing console errors, overflow, or failed images.

Sicherheitsaudit

Hohes Risiko

v2 • 5.10.2026 Versionsbericht öffnen

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

Gescannte Dateien

3,794

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

Mittel

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

Elemente der Fähigkeitsprüfung (2)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

Mittel

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

Risikofaktoren

⚡ Enthält Skripte (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ Externe Befehle (50)

🌐 Netzwerkzugriff (50)

📁 Dateisystemzugriff (44)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166

🔑 Umgebungsvariablen (34)

Geprüft von: codex Audit-Verlauf anzeigen →

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/oil-oil-oil-ui/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg)](https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/oil-oil-oil-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

oil-oil. (2026). oil-ui security audit report (audit version 2) [Author version 0.15.5]. Skillstore. https://skillstore.io/skills/oil-oil-oil-ui/audits/2

BibTeX-Zitat

@techreport{oil-oil-oil-oil-oil-ui-2026,
  author = {oil-oil},
  title = {oil-ui security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/oil-oil-oil-ui/audits/2},
  note = {Author version 0.15.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "oil-ui security audit report (audit version 2)"
version: "0.15.5"
type: report
authors:
  - name: "oil-oil"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/oil-oil-oil-ui/audits/2"
identifiers:
  - type: other
    value: "skillstore:oil-oil-oil-ui:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Choose a Product Direction

Compare distinct interface directions before selecting typography, imagery, and composition for implementation.

Refine an Existing Interface

Improve hierarchy and spacing while preserving established brand assets, components, and project conventions.

Review a Proposed Experience

Inspect desktop and mobile evidence, record visible problems, and prioritize changes without modifying project files.

Diese Prompts ausprobieren

Review One Screen

Review this screen for hierarchy, spacing, typography, and readability. Keep files unchanged and distinguish visible defects from style preferences.

Compare Design Directions

Explore three distinct directions for this product. Keep the audience, content, and main action consistent, then create a comparison page.

Recreate a Reference

Recreate this reference at its documented viewport. Add a mobile layout and label assumptions where the reference does not show behavior.

Refine and Verify a Workflow

Refine this workflow using existing components. Capture key states and motion evidence, request an independent visual review, and report remaining gaps.

Bewährte Praktiken

Define the audience, main action, actual content, target viewport, and deliverable before exploring directions.
Inspect actual-size desktop and mobile renders; record unverified behavior and keep screenshots tied to the current version.
Use trusted candidates in a dedicated preview directory, approve saved commands, and authorize updates separately.

Vermeiden

Treating a static screenshot or scaled preview as proof of working interaction or mobile reflow.
Executing stored manifest commands or external updates without reviewing their source and scope.
Previewing untrusted scripts beside private files or claiming interactive previews cannot make external requests.

Häufig gestellte Fragen

Which assistants can use this skill?

The workflow supports Claude, Codex, and Claude Code. Optional generation and capture depend on the host environment.

Does it produce working interfaces?

It can guide implementation and prototypes, but business logic and comprehensive code correctness remain outside its stated scope.

Can comparison pages work offline?

Embedded static HTML and image candidates are portable. Live candidates need a local server; interactive scripts do not guarantee complete network isolation.

What does screenshot capture require?

The bundled tool needs Node.js 22+ and Chrome, Chromium, or Edge. Video assembly additionally needs ffmpeg.

Does it update automatically?

Default checks only read public version information. Explicit --update approval runs a pinned external CLI that can replace the installation.

Can it review an interface without editing files?

Yes. Review-only requests remain read-only, and independent visual review requires an isolated reviewer that can inspect images.