📦

wunderui-setup

Name: wunderui-setup
Author: wunder-ui

Révision du contenu r1 Risque élevé 🌐 Accès réseau⚡ Contient des scripts⚙️ Commandes externes📁 Accès au système de fichiers

Set Up WunderUI in Your React Project

WunderUI components can appear unstyled when package installation, Tailwind scanning, or token precedence is incomplete. This skill coordinates setup, creates a verification component, and documents remaining checks.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "wunderui-setup" from https://skillstore.io/skills/wunder-ui-wunderui-setup.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/wunder-ui-wunderui-setup.md manifest signé GET /api/skills/wunder-ui-wunderui-setup/manifest lockfile signé GET /api/skills/wunder-ui-wunderui-setup/lockfile

Tester

Utilisation de « wunderui-setup ». Check whether my Tailwind v3 project is ready for WunderUI.

Résultat attendu:

Readiness: Tailwind v3 does not meet the supported styling requirement.
Next action: approve a Tailwind v4 upgrade before continuing setup.
Verification: a styled WunderUI probe remains pending.

Utilisation de « wunderui-setup ». Summarize setup after creating the probe and registering MCP.

Résultat attendu:

Setup report: lists the detected framework, CSS entry, package information, and recorded changes.
Browser check: confirm the probe button background is not transparent.
MCP check: restart the editor and call get_library_info.
Remaining work: confirm token precedence before building the first screen.

Audit de sécurité

Risque élevé

v1 • 10/10/2026 Ouvrir le rapport versionné

Most static alerts are formatting, regular expression matching, or expected project file access. Confirmed command execution risks include shell interpolation of checkout paths and npm output. Additional risks include unverified persistent agent rules, an unpinned MCP launcher, and package execution during checkout dry runs; no malicious payload was found.

Fichiers analysés

366

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (3)

Élevé

scripts/setup.mjs:105-123 SKILL.md:25

Unverified References Become Persistent Agent Instructions

The helper fetches mutable instruction files and inserts their contents into CLAUDE.md or AGENTS.md. Compromised references could persistently redirect future agent behavior.

The download-to-rules pipeline has no integrity verification or content approval step. No malicious instruction payload was found in the audited files.

Moyen

scripts/setup.mjs:12 scripts/setup.mjs:139-148

Checkout Dry Runs Execute Package Operations

Despite the documented write-free --dry option, checkout installation creates .wunderui and executes npm pack before checking DRY. Package lifecycle scripts can run during preview.

Directory creation and execSync precede the DRY guard unconditionally in the checkout branch. npm pack can run lifecycle hooks unless scripts are disabled.

Moyen

scripts/setup.mjs:155-170 SKILL.md:28-31

Unpinned MCP Package Executes Through Agent Configuration

Without a local MCP entrypoint, generated editor configuration launches npx -y wunderui-mcp without a version pin. A changed registry release can execute when loaded.

The generated command accepts automatic package retrieval and specifies no reviewed version. No malicious package release or actual execution was observed.

Éléments d’évaluation des capacités (4)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

scripts/setup.mjs:144

Synchronous process execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

execSync interpolates checkout and project paths into a shell command. Double quotes do not prevent command substitution in crafted paths.

Élevé

scripts/setup.mjs:149

Synchronous process execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

The checkout branch constructs target from npm pack output and passes it unquoted to a shell. Crafted archive names can alter shell parsing.

Élevé

scripts/setup.mjs:144

Ruby/shell backtick execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

Although the syntax is JavaScript, this string is passed directly to execSync. Crafted paths can trigger shell command substitution.

Élevé

scripts/setup.mjs:149

Ruby/shell backtick execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

This template literal actually enters execSync, unlike ordinary string formatting. The unquoted target derived from npm output creates shell parsing risk.

Facteurs de risque

🌐 Accès réseau (5)

package.json:17 scripts/setup.mjs:108 scripts/setup.mjs:108 scripts/setup.mjs:109 SKILL.md:25

⚡ Contient des scripts (1)

scripts/setup.mjs:189

⚙️ Commandes externes (47)

📁 Accès au système de fichiers (17)

scripts/setup.mjs:13 scripts/setup.mjs:24 scripts/setup.mjs:26 scripts/setup.mjs:29 scripts/setup.mjs:65 scripts/setup.mjs:68 scripts/setup.mjs:113 scripts/setup.mjs:117 scripts/setup.mjs:180 scripts/setup.mjs:252 scripts/setup.mjs:65 scripts/setup.mjs:145 scripts/setup.mjs:186 scripts/setup.mjs:187 scripts/setup.mjs:189 scripts/setup.mjs:196 scripts/setup.mjs:205

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

wunder-ui. (2026). wunderui-setup security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1

Citation BibTeX

@techreport{wunder-ui-wunder-ui-wunderui-setup-2026,
  author = {wunder-ui},
  title = {wunderui-setup security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-setup security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-setup:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Configure a New React Interface

Add WunderUI to an existing React project and inspect a small component probe before building application screens.

Resolve Unstyled Components

Check Tailwind source scanning, stylesheet imports, and token precedence when existing WunderUI components render without expected styles.

Standardize Team Setup

Review design references and MCP configuration, then document project prerequisites and pending verification for a team handoff.

Essayez ces prompts

Inspect Prerequisites

Inspect my React project with WunderUI detection in dry mode. Identify the framework, Tailwind version, and CSS entry without installing packages.

Set Up With Approval

Set up WunderUI for my Free plan. Ask before installation or edits, and show downloaded agent instructions for review before inserting them.

Diagnose Styling Problems

Diagnose why my WunderUI buttons are unstyled. Check the Tailwind source path and stylesheet order, preserve my tokens, and verify the probe.

Review a Local Checkout

Review my built WunderUI checkout before setup. Check shell arguments, lifecycle scripts, and MCP version trust; require approval before execution and report remaining checks.

Bonnes pratiques

Review dependency sources, lifecycle scripts, downloaded rules, and the MCP launcher before approving execution.
Run detection first, confirm Tailwind v4, and agree on token precedence before editing the CSS entry.
Keep a recoverable project snapshot, inspect changes, and verify both the probe rendering and MCP availability.

Éviter

Treating --dry checkout installation as a guarantee that no subprocesses run or files change.
Automatically trusting downloaded instruction files or an unpinned MCP package.
Removing project token overrides or declaring setup complete without consent and browser verification.