📦

oil-ui

Name: oil-ui
Author: oil-oil

v0.15.5 Révision du contenu r2 Risque élevé ⚡ Contient des scripts⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement

Explore and Refine Interface Designs

Interface projects often need clear visual direction before implementation. Oil UI guides design exploration, preview comparison, and evidence-based refinement.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "oil-ui" from https://skillstore.io/skills/oil-oil-oil-ui.md and its manifest at https://skillstore.io/api/skills/oil-oil-oil-ui/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/oil-oil-oil-ui.md manifest signé GET /api/skills/oil-oil-oil-ui/manifest lockfile signé GET /api/skills/oil-oil-oil-ui/lockfile

Tester

Utilisation de « oil-ui ». Compare three visual directions for a course booking interface.

Résultat attendu:

A comparison page with three distinct compositions, documented palettes, typography choices, and desktop and mobile views.
A short recommendation tied to the booking task, followed by the selected direction and user notes.

Utilisation de « oil-ui ». Review an existing interface without changing files.

Résultat attendu:

The primary action competes with secondary navigation. Reduce secondary emphasis and align the action with the current task.
The mobile heading wraps poorly. Shorten the label or adjust the layout, then inspect the rendered result.
Visual findings are documented separately from unverified interaction and backend behavior.

Utilisation de « oil-ui ». Capture evidence for an interactive prototype.

Résultat attendu:

Desktop and mobile screenshots, a text-masked comparison, motion frames, and a report listing console errors, overflow, or failed images.

Audit de sécurité

Risque élevé

v2 • 05/10/2026 Ouvrir le rapport versionné

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

Fichiers analysés

3,794

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Élevé

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

Moyen

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

Éléments d’évaluation des capacités (2)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

Moyen

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

Facteurs de risque

⚡ Contient des scripts (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ Commandes externes (50)

🌐 Accès réseau (50)

📁 Accès au système de fichiers (44)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166

🔑 Variables d’environnement (34)

Audité par: codex Voir l’historique des audits →

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/oil-oil-oil-ui/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg)](https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/oil-oil-oil-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

oil-oil. (2026). oil-ui security audit report (audit version 2) [Author version 0.15.5]. Skillstore. https://skillstore.io/skills/oil-oil-oil-ui/audits/2

Citation BibTeX

@techreport{oil-oil-oil-oil-oil-ui-2026,
  author = {oil-oil},
  title = {oil-ui security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/oil-oil-oil-ui/audits/2},
  note = {Author version 0.15.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "oil-ui security audit report (audit version 2)"
version: "0.15.5"
type: report
authors:
  - name: "oil-oil"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/oil-oil-oil-ui/audits/2"
identifiers:
  - type: other
    value: "skillstore:oil-oil-oil-ui:audit:2"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Choose a Product Direction

Compare distinct interface directions before selecting typography, imagery, and composition for implementation.

Refine an Existing Interface

Improve hierarchy and spacing while preserving established brand assets, components, and project conventions.

Review a Proposed Experience

Inspect desktop and mobile evidence, record visible problems, and prioritize changes without modifying project files.

Essayez ces prompts

Review One Screen

Review this screen for hierarchy, spacing, typography, and readability. Keep files unchanged and distinguish visible defects from style preferences.

Compare Design Directions

Explore three distinct directions for this product. Keep the audience, content, and main action consistent, then create a comparison page.

Recreate a Reference

Recreate this reference at its documented viewport. Add a mobile layout and label assumptions where the reference does not show behavior.

Refine and Verify a Workflow

Refine this workflow using existing components. Capture key states and motion evidence, request an independent visual review, and report remaining gaps.

Bonnes pratiques

Define the audience, main action, actual content, target viewport, and deliverable before exploring directions.
Inspect actual-size desktop and mobile renders; record unverified behavior and keep screenshots tied to the current version.
Use trusted candidates in a dedicated preview directory, approve saved commands, and authorize updates separately.

Éviter

Treating a static screenshot or scaled preview as proof of working interaction or mobile reflow.
Executing stored manifest commands or external updates without reviewing their source and scope.
Previewing untrusted scripts beside private files or claiming interactive previews cannot make external requests.

Foire aux questions

Which assistants can use this skill?

The workflow supports Claude, Codex, and Claude Code. Optional generation and capture depend on the host environment.

Does it produce working interfaces?

It can guide implementation and prototypes, but business logic and comprehensive code correctness remain outside its stated scope.

Can comparison pages work offline?

Embedded static HTML and image candidates are portable. Live candidates need a local server; interactive scripts do not guarantee complete network isolation.

What does screenshot capture require?

The bundled tool needs Node.js 22+ and Chrome, Chromium, or Edge. Video assembly additionally needs ffmpeg.

Does it update automatically?

Default checks only read public version information. Explicit --update approval runs a pinned external CLI that can replace the installation.

Can it review an interface without editing files?

Yes. Review-only requests remain read-only, and independent visual review requires an isolated reviewer that can inspect images.