Habilidades wunderui-token-check

📦

wunderui-token-check

Name: wunderui-token-check
Author: wunder-ui

Revisión del contenido r1 Riesgo medio 🌐 Acceso a red⚙️ Comandos externos⚡ Contiene scripts📁 Acceso al sistema de archivos

Replace Hardcoded Styles with WunderUI Tokens

Hardcoded colors and dimensions make WunderUI projects harder to theme consistently. This skill compares literals with bundled tokens and supports reviewed replacements with measured differences.

Compatible con: Claude Codex Code(CC)

📊 71 Adecuado

Maintain this Skill? Claim it 📊 71 Adecuado

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "wunderui-token-check" from https://skillstore.io/skills/wunder-ui-wunderui-token-check.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-token-check/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/wunder-ui-wunderui-token-check.md Manifest firmado GET /api/skills/wunder-ui-wunderui-token-check/manifest Lockfile firmado GET /api/skills/wunder-ui-wunderui-token-check/lockfile

Pruébalo

Usando "wunderui-token-check". Inspect a component with arbitrary padding of 16 pixels and a radius of 10 pixels.

Resultado esperado:

Padding: the spacing scale has an exact 16-pixel match, classified as swap.
Radius: the nearest bundled radius is 8 pixels, a 2-pixel difference classified as visible.
No source edits were requested.

Usando "wunderui-token-check". Inspect a fixed white background before adding dark mode.

Resultado esperado:

Fixed white background: classified as visible because replacing it with a semantic token changes dark-mode behavior.
The bundled background token is white in light mode and dark in dark mode.
Review the intended surface role before approving a replacement.

Auditoría de seguridad

Riesgo medio

v1 • 10/10/2026 Abrir el informe versionado

Most static findings match harmless regular expressions, template strings, documentation, or expected local operations. Four findings confirm unsafe report output or report-supplied paths, allowing external file overwrites through symlinks or a tampered report. A separate semantic finding identifies symlink traversal during scanning; no evidence found of malicious intent, prompt injection, credential collection, or network transmission.

Archivos escaneados

1,438

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio

scripts/token-check.mjs:97-109

Symlinks Can Expand Scan Scope

The scanner follows symlinks with statSync and recurses without realpath containment or cycle detection. A repository link can expose external source literals in reports or cause recursive resource exhaustion.

statSync follows links, and walk recursively processes targets without checking real paths or visited directories. The implementation directly permits scope escape and directory cycles.

Elementos de revisión de capacidades (4)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

scripts/token-check.mjs:231

Synchronous file operations

writeFileSync(join(cwd, file), lines.join("\n"))

Fix writes report-selected file paths without checking project containment. A tampered report can replace matching text in writable files outside the project.

Medio

scripts/token-check.mjs:193

Synchronous file operations

writeFileSync(OUT, JSON.stringify({ scanned: list.length, tokens: TOKENS.source, findings }, null, 2

writeFileSync follows existing symlinks at the report file or directory without checking the real target. An attacker-controlled project can redirect report output to overwrite an external writable file.

Medio

scripts/token-check.mjs:202

Synchronous file operations

const data = JSON.parse(readFileSync(OUT, "utf8"))

Fix loads editable report findings without validating paths or binding them to the original scan. A tampered report controls downstream file targets and replacements.

Medio

scripts/token-check.mjs:220

Synchronous file operations

const lines = readFileSync(join(cwd, file), "utf8").split("\n")

The file path comes from report findings and is joined with cwd without containment checks. Parent-directory traversal can read files outside the project.

Factores de riesgo

🌐 Acceso a red (1)

package.json:17

⚙️ Comandos externos (48)

⚡ Contiene scripts (4)

scripts/token-check.mjs:28 scripts/token-check.mjs:35 scripts/token-check.mjs:40 scripts/token-check.mjs:47

📁 Acceso al sistema de archivos (19)

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-token-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

wunder-ui. (2026). wunderui-token-check security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1

Cita BibTeX

@techreport{wunder-ui-wunder-ui-wunderui-token-check-2026,
  author = {wunder-ui},
  title = {wunderui-token-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-token-check security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-token-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Clean Up Component Styles

Compare component literals with WunderUI tokens and review supported replacements before editing source.

Review Token Coverage

Group distant values and decide whether each needs an existing semantic token, a new token, or an explicit exception.

Prepare Theme Changes

Inspect fixed colors and suggested light and dark values before planning a theming migration.

Prueba estos prompts

Inspect Without Editing

Check my trusted WunderUI project for hardcoded colors, spacing, and radii. Inspect symlinks before scanning. Summarize findings without changing source files.

Review One Component

Scan this component and explain its nearest tokens and measured differences. Compare suggested light and dark values. Do not apply replacements until I approve.

Apply Approved Matches

Generate a fresh report for these trusted source folders. Show the proposed swap replacements and wait for approval. Then apply them, rescan, and run project checks.

Plan a Theme Migration

Group review findings by value and semantic role. Recommend mappings or exceptions, including dark-mode effects. Propose explicit selections for approval and identify manual spacing edits.

Mejores prácticas

Use a clean version-control checkpoint, trusted source folders, and a freshly generated report; inspect symlinks and report targets before fixing.
Approve replacements by semantic role and inspect both theme modes rather than relying only on measured distance.
Rescan after edits, review the diff, run project checks, and inspect affected components visually.

Evitar

Running fix against a supplied or tampered report without checking its paths and replacements.
Treating low color distance as proof of accessibility, transparency preservation, or identical dark-mode behavior.
Replacing every review finding automatically or changing artwork and brand colors without a design decision.

Preguntas frecuentes

Which assistants can use this skill?

The report lists Claude, Codex, and Claude Code. Running the bundled scanner requires an environment that can execute local Node.js commands.

What must my project provide?

Use Node.js 20 or later and a WunderUI project with the corresponding tokens available. The script has no package dependencies.

What do swap, visible, and review mean?

Swap means color distance at most 2 or an exact dimension match. Visible allows distance at most 6 or 2 pixels. Review needs a design decision.

Does it rewrite every finding?

No. Default fix selects swap findings; visible findings require an option. CSS spacing declarations and unsupported inline dimensions need manual edits.

Does it send project data to a service?

No network transmission was found in the reviewed files. The script reads local source and writes a local report.

What security precautions are necessary?

Fix does not validate report paths, and scanning follows symlinks. Use trusted projects, regenerate reports, inspect targets, and keep recoverable source changes.