📦

wunderui-setup

Name: wunderui-setup
Author: wunder-ui

Inhaltsrevision r1 Hohes Risiko 🌐 Netzwerkzugriff⚡ Enthält Skripte⚙️ Externe Befehle📁 Dateisystemzugriff

Set Up WunderUI in Your React Project

WunderUI components can appear unstyled when package installation, Tailwind scanning, or token precedence is incomplete. This skill coordinates setup, creates a verification component, and documents remaining checks.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "wunderui-setup" from https://skillstore.io/skills/wunder-ui-wunderui-setup.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/wunder-ui-wunderui-setup.md Signiertes manifest GET /api/skills/wunder-ui-wunderui-setup/manifest Signiertes lockfile GET /api/skills/wunder-ui-wunderui-setup/lockfile

Testen

„wunderui-setup“ wird verwendet. Check whether my Tailwind v3 project is ready for WunderUI.

Erwartetes Ergebnis:

Readiness: Tailwind v3 does not meet the supported styling requirement.
Next action: approve a Tailwind v4 upgrade before continuing setup.
Verification: a styled WunderUI probe remains pending.

„wunderui-setup“ wird verwendet. Summarize setup after creating the probe and registering MCP.

Erwartetes Ergebnis:

Setup report: lists the detected framework, CSS entry, package information, and recorded changes.
Browser check: confirm the probe button background is not transparent.
MCP check: restart the editor and call get_library_info.
Remaining work: confirm token precedence before building the first screen.

Sicherheitsaudit

Hohes Risiko

v1 • 10.10.2026 Versionsbericht öffnen

Most static alerts are formatting, regular expression matching, or expected project file access. Confirmed command execution risks include shell interpolation of checkout paths and npm output. Additional risks include unverified persistent agent rules, an unpinned MCP launcher, and package execution during checkout dry runs; no malicious payload was found.

Gescannte Dateien

366

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (3)

Hoch

scripts/setup.mjs:105-123 SKILL.md:25

Unverified References Become Persistent Agent Instructions

The helper fetches mutable instruction files and inserts their contents into CLAUDE.md or AGENTS.md. Compromised references could persistently redirect future agent behavior.

The download-to-rules pipeline has no integrity verification or content approval step. No malicious instruction payload was found in the audited files.

Mittel

scripts/setup.mjs:12 scripts/setup.mjs:139-148

Checkout Dry Runs Execute Package Operations

Despite the documented write-free --dry option, checkout installation creates .wunderui and executes npm pack before checking DRY. Package lifecycle scripts can run during preview.

Directory creation and execSync precede the DRY guard unconditionally in the checkout branch. npm pack can run lifecycle hooks unless scripts are disabled.

Mittel

scripts/setup.mjs:155-170 SKILL.md:28-31

Unpinned MCP Package Executes Through Agent Configuration

Without a local MCP entrypoint, generated editor configuration launches npx -y wunderui-mcp without a version pin. A changed registry release can execute when loaded.

The generated command accepts automatic package retrieval and specifies no reviewed version. No malicious package release or actual execution was observed.

Elemente der Fähigkeitsprüfung (4)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

scripts/setup.mjs:144

Synchronous process execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

execSync interpolates checkout and project paths into a shell command. Double quotes do not prevent command substitution in crafted paths.

Hoch

scripts/setup.mjs:149

Synchronous process execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

The checkout branch constructs target from npm pack output and passes it unquoted to a shell. Crafted archive names can alter shell parsing.

Hoch

scripts/setup.mjs:144

Ruby/shell backtick execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

Although the syntax is JavaScript, this string is passed directly to execSync. Crafted paths can trigger shell command substitution.

Hoch

scripts/setup.mjs:149

Ruby/shell backtick execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

This template literal actually enters execSync, unlike ordinary string formatting. The unquoted target derived from npm output creates shell parsing risk.

Risikofaktoren

🌐 Netzwerkzugriff (5)

package.json:17 scripts/setup.mjs:108 scripts/setup.mjs:108 scripts/setup.mjs:109 SKILL.md:25

⚡ Enthält Skripte (1)

scripts/setup.mjs:189

⚙️ Externe Befehle (47)

📁 Dateisystemzugriff (17)

scripts/setup.mjs:13 scripts/setup.mjs:24 scripts/setup.mjs:26 scripts/setup.mjs:29 scripts/setup.mjs:65 scripts/setup.mjs:68 scripts/setup.mjs:113 scripts/setup.mjs:117 scripts/setup.mjs:180 scripts/setup.mjs:252 scripts/setup.mjs:65 scripts/setup.mjs:145 scripts/setup.mjs:186 scripts/setup.mjs:187 scripts/setup.mjs:189 scripts/setup.mjs:196 scripts/setup.mjs:205

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

wunder-ui. (2026). wunderui-setup security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1

BibTeX-Zitat

@techreport{wunder-ui-wunder-ui-wunderui-setup-2026,
  author = {wunder-ui},
  title = {wunderui-setup security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-setup security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-setup:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Configure a New React Interface

Add WunderUI to an existing React project and inspect a small component probe before building application screens.

Resolve Unstyled Components

Check Tailwind source scanning, stylesheet imports, and token precedence when existing WunderUI components render without expected styles.

Standardize Team Setup

Review design references and MCP configuration, then document project prerequisites and pending verification for a team handoff.

Diese Prompts ausprobieren

Inspect Prerequisites

Inspect my React project with WunderUI detection in dry mode. Identify the framework, Tailwind version, and CSS entry without installing packages.

Set Up With Approval

Set up WunderUI for my Free plan. Ask before installation or edits, and show downloaded agent instructions for review before inserting them.

Diagnose Styling Problems

Diagnose why my WunderUI buttons are unstyled. Check the Tailwind source path and stylesheet order, preserve my tokens, and verify the probe.

Review a Local Checkout

Review my built WunderUI checkout before setup. Check shell arguments, lifecycle scripts, and MCP version trust; require approval before execution and report remaining checks.

Bewährte Praktiken

Review dependency sources, lifecycle scripts, downloaded rules, and the MCP launcher before approving execution.
Run detection first, confirm Tailwind v4, and agree on token precedence before editing the CSS entry.
Keep a recoverable project snapshot, inspect changes, and verify both the probe rendering and MCP availability.

Vermeiden

Treating --dry checkout installation as a guarantee that no subprocesses run or files change.
Automatically trusting downloaded instruction files or an unpinned MCP package.
Removing project token overrides or declaring setup complete without consent and browser verification.