📦

oil-ui

Name: oil-ui
Author: oil-oil

v0.15.5 Revisión del contenido r2 Riesgo alto ⚡ Contiene scripts⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Explore and Refine Interface Designs

Interface projects often need clear visual direction before implementation. Oil UI guides design exploration, preview comparison, and evidence-based refinement.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "oil-ui" from https://skillstore.io/skills/oil-oil-oil-ui.md and its manifest at https://skillstore.io/api/skills/oil-oil-oil-ui/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/oil-oil-oil-ui.md Manifest firmado GET /api/skills/oil-oil-oil-ui/manifest Lockfile firmado GET /api/skills/oil-oil-oil-ui/lockfile

Pruébalo

Usando "oil-ui". Compare three visual directions for a course booking interface.

Resultado esperado:

A comparison page with three distinct compositions, documented palettes, typography choices, and desktop and mobile views.
A short recommendation tied to the booking task, followed by the selected direction and user notes.

Usando "oil-ui". Review an existing interface without changing files.

Resultado esperado:

The primary action competes with secondary navigation. Reduce secondary emphasis and align the action with the current task.
The mobile heading wraps poorly. Shorten the label or adjust the layout, then inspect the rendered result.
Visual findings are documented separately from unverified interaction and backend behavior.

Usando "oil-ui". Capture evidence for an interactive prototype.

Resultado esperado:

Desktop and mobile screenshots, a text-masked comparison, motion frames, and a report listing console errors, overflow, or failed images.

Auditoría de seguridad

Riesgo alto

v2 • 5/10/2026 Abrir el informe versionado

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

Archivos escaneados

3,794

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (2)

Alto

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

Medio

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

Medio

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

Factores de riesgo

⚡ Contiene scripts (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ Comandos externos (50)

🌐 Acceso a red (50)

📁 Acceso al sistema de archivos (44)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166

🔑 Variables de entorno (34)

Auditado por: codex Ver historial de auditorías →

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/oil-oil-oil-ui/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg)](https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/oil-oil-oil-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

oil-oil. (2026). oil-ui security audit report (audit version 2) [Author version 0.15.5]. Skillstore. https://skillstore.io/skills/oil-oil-oil-ui/audits/2

Cita BibTeX

@techreport{oil-oil-oil-oil-oil-ui-2026,
  author = {oil-oil},
  title = {oil-ui security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/oil-oil-oil-ui/audits/2},
  note = {Author version 0.15.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "oil-ui security audit report (audit version 2)"
version: "0.15.5"
type: report
authors:
  - name: "oil-oil"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/oil-oil-oil-ui/audits/2"
identifiers:
  - type: other
    value: "skillstore:oil-oil-oil-ui:audit:2"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Choose a Product Direction

Compare distinct interface directions before selecting typography, imagery, and composition for implementation.

Refine an Existing Interface

Improve hierarchy and spacing while preserving established brand assets, components, and project conventions.

Review a Proposed Experience

Inspect desktop and mobile evidence, record visible problems, and prioritize changes without modifying project files.

Prueba estos prompts

Review One Screen

Review this screen for hierarchy, spacing, typography, and readability. Keep files unchanged and distinguish visible defects from style preferences.

Compare Design Directions

Explore three distinct directions for this product. Keep the audience, content, and main action consistent, then create a comparison page.

Recreate a Reference

Recreate this reference at its documented viewport. Add a mobile layout and label assumptions where the reference does not show behavior.

Refine and Verify a Workflow

Refine this workflow using existing components. Capture key states and motion evidence, request an independent visual review, and report remaining gaps.

Mejores prácticas

Define the audience, main action, actual content, target viewport, and deliverable before exploring directions.
Inspect actual-size desktop and mobile renders; record unverified behavior and keep screenshots tied to the current version.
Use trusted candidates in a dedicated preview directory, approve saved commands, and authorize updates separately.

Evitar

Treating a static screenshot or scaled preview as proof of working interaction or mobile reflow.
Executing stored manifest commands or external updates without reviewing their source and scope.
Previewing untrusted scripts beside private files or claiming interactive previews cannot make external requests.

Preguntas frecuentes

Which assistants can use this skill?

The workflow supports Claude, Codex, and Claude Code. Optional generation and capture depend on the host environment.

Does it produce working interfaces?

It can guide implementation and prototypes, but business logic and comprehensive code correctness remain outside its stated scope.

Can comparison pages work offline?

Embedded static HTML and image candidates are portable. Live candidates need a local server; interactive scripts do not guarantee complete network isolation.

What does screenshot capture require?

The bundled tool needs Node.js 22+ and Chrome, Chromium, or Edge. Video assembly additionally needs ffmpeg.

Does it update automatically?

Default checks only read public version information. Explicit --update approval runs a pinned external CLI that can replace the installation.

Can it review an interface without editing files?

Yes. Review-only requests remain read-only, and independent visual review requires an isolated reviewer that can inspect images.