Fähigkeiten wunderui-token-check

📦

wunderui-token-check

Name: wunderui-token-check
Author: wunder-ui

Inhaltsrevision r1 Mittleres Risiko 🌐 Netzwerkzugriff⚙️ Externe Befehle⚡ Enthält Skripte📁 Dateisystemzugriff

Replace Hardcoded Styles with WunderUI Tokens

Hardcoded colors and dimensions make WunderUI projects harder to theme consistently. This skill compares literals with bundled tokens and supports reviewed replacements with measured differences.

Unterstützt: Claude Codex Code(CC)

📊 71 Angemessen

Maintain this Skill? Claim it 📊 71 Angemessen

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "wunderui-token-check" from https://skillstore.io/skills/wunder-ui-wunderui-token-check.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-token-check/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/wunder-ui-wunderui-token-check.md Signiertes manifest GET /api/skills/wunder-ui-wunderui-token-check/manifest Signiertes lockfile GET /api/skills/wunder-ui-wunderui-token-check/lockfile

Testen

„wunderui-token-check“ wird verwendet. Inspect a component with arbitrary padding of 16 pixels and a radius of 10 pixels.

Erwartetes Ergebnis:

Padding: the spacing scale has an exact 16-pixel match, classified as swap.
Radius: the nearest bundled radius is 8 pixels, a 2-pixel difference classified as visible.
No source edits were requested.

„wunderui-token-check“ wird verwendet. Inspect a fixed white background before adding dark mode.

Erwartetes Ergebnis:

Fixed white background: classified as visible because replacing it with a semantic token changes dark-mode behavior.
The bundled background token is white in light mode and dark in dark mode.
Review the intended surface role before approving a replacement.

Sicherheitsaudit

Mittleres Risiko

v1 • 10.10.2026 Versionsbericht öffnen

Most static findings match harmless regular expressions, template strings, documentation, or expected local operations. Four findings confirm unsafe report output or report-supplied paths, allowing external file overwrites through symlinks or a tampered report. A separate semantic finding identifies symlink traversal during scanning; no evidence found of malicious intent, prompt injection, credential collection, or network transmission.

Gescannte Dateien

1,438

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

scripts/token-check.mjs:97-109

Symlinks Can Expand Scan Scope

The scanner follows symlinks with statSync and recurses without realpath containment or cycle detection. A repository link can expose external source literals in reports or cause recursive resource exhaustion.

statSync follows links, and walk recursively processes targets without checking real paths or visited directories. The implementation directly permits scope escape and directory cycles.

Elemente der Fähigkeitsprüfung (4)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Hoch

scripts/token-check.mjs:231

Synchronous file operations

writeFileSync(join(cwd, file), lines.join("\n"))

Fix writes report-selected file paths without checking project containment. A tampered report can replace matching text in writable files outside the project.

Mittel

scripts/token-check.mjs:193

Synchronous file operations

writeFileSync(OUT, JSON.stringify({ scanned: list.length, tokens: TOKENS.source, findings }, null, 2

writeFileSync follows existing symlinks at the report file or directory without checking the real target. An attacker-controlled project can redirect report output to overwrite an external writable file.

Mittel

scripts/token-check.mjs:202

Synchronous file operations

const data = JSON.parse(readFileSync(OUT, "utf8"))

Fix loads editable report findings without validating paths or binding them to the original scan. A tampered report controls downstream file targets and replacements.

Mittel

scripts/token-check.mjs:220

Synchronous file operations

const lines = readFileSync(join(cwd, file), "utf8").split("\n")

The file path comes from report findings and is joined with cwd without containment checks. Parent-directory traversal can read files outside the project.

Risikofaktoren

🌐 Netzwerkzugriff (1)

package.json:17

⚙️ Externe Befehle (48)

⚡ Enthält Skripte (4)

scripts/token-check.mjs:28 scripts/token-check.mjs:35 scripts/token-check.mjs:40 scripts/token-check.mjs:47

📁 Dateisystemzugriff (19)

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-token-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

wunder-ui. (2026). wunderui-token-check security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1

BibTeX-Zitat

@techreport{wunder-ui-wunder-ui-wunderui-token-check-2026,
  author = {wunder-ui},
  title = {wunderui-token-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-token-check security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-token-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Clean Up Component Styles

Compare component literals with WunderUI tokens and review supported replacements before editing source.

Review Token Coverage

Group distant values and decide whether each needs an existing semantic token, a new token, or an explicit exception.

Prepare Theme Changes

Inspect fixed colors and suggested light and dark values before planning a theming migration.

Diese Prompts ausprobieren

Inspect Without Editing

Check my trusted WunderUI project for hardcoded colors, spacing, and radii. Inspect symlinks before scanning. Summarize findings without changing source files.

Review One Component

Scan this component and explain its nearest tokens and measured differences. Compare suggested light and dark values. Do not apply replacements until I approve.

Apply Approved Matches

Generate a fresh report for these trusted source folders. Show the proposed swap replacements and wait for approval. Then apply them, rescan, and run project checks.

Plan a Theme Migration

Group review findings by value and semantic role. Recommend mappings or exceptions, including dark-mode effects. Propose explicit selections for approval and identify manual spacing edits.

Bewährte Praktiken

Use a clean version-control checkpoint, trusted source folders, and a freshly generated report; inspect symlinks and report targets before fixing.
Approve replacements by semantic role and inspect both theme modes rather than relying only on measured distance.
Rescan after edits, review the diff, run project checks, and inspect affected components visually.

Vermeiden

Running fix against a supplied or tampered report without checking its paths and replacements.
Treating low color distance as proof of accessibility, transparency preservation, or identical dark-mode behavior.
Replacing every review finding automatically or changing artwork and brand colors without a design decision.

Häufig gestellte Fragen

Which assistants can use this skill?

The report lists Claude, Codex, and Claude Code. Running the bundled scanner requires an environment that can execute local Node.js commands.

What must my project provide?

Use Node.js 20 or later and a WunderUI project with the corresponding tokens available. The script has no package dependencies.

What do swap, visible, and review mean?

Swap means color distance at most 2 or an exact dimension match. Visible allows distance at most 6 or 2 pixels. Review needs a design decision.

Does it rewrite every finding?

No. Default fix selects swap findings; visible findings require an option. CSS spacing declarations and unsupported inline dimensions need manual edits.

Does it send project data to a service?

No network transmission was found in the reviewed files. The script reads local source and writes a local report.

What security precautions are necessary?

Fix does not validate report paths, and scanning follows symlinks. Use trusted projects, regenerate reports, inspect targets, and keep recoverable source changes.