Compétences wunderui-token-check

📦

wunderui-token-check

Name: wunderui-token-check
Author: wunder-ui

Révision du contenu r1 Risque moyen 🌐 Accès réseau⚙️ Commandes externes⚡ Contient des scripts📁 Accès au système de fichiers

Replace Hardcoded Styles with WunderUI Tokens

Hardcoded colors and dimensions make WunderUI projects harder to theme consistently. This skill compares literals with bundled tokens and supports reviewed replacements with measured differences.

Prend en charge: Claude Codex Code(CC)

📊 71 Adéquat

Maintain this Skill? Claim it 📊 71 Adéquat

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "wunderui-token-check" from https://skillstore.io/skills/wunder-ui-wunderui-token-check.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-token-check/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/wunder-ui-wunderui-token-check.md manifest signé GET /api/skills/wunder-ui-wunderui-token-check/manifest lockfile signé GET /api/skills/wunder-ui-wunderui-token-check/lockfile

Tester

Utilisation de « wunderui-token-check ». Inspect a component with arbitrary padding of 16 pixels and a radius of 10 pixels.

Résultat attendu:

Padding: the spacing scale has an exact 16-pixel match, classified as swap.
Radius: the nearest bundled radius is 8 pixels, a 2-pixel difference classified as visible.
No source edits were requested.

Utilisation de « wunderui-token-check ». Inspect a fixed white background before adding dark mode.

Résultat attendu:

Fixed white background: classified as visible because replacing it with a semantic token changes dark-mode behavior.
The bundled background token is white in light mode and dark in dark mode.
Review the intended surface role before approving a replacement.

Audit de sécurité

Risque moyen

v1 • 10/10/2026 Ouvrir le rapport versionné

Most static findings match harmless regular expressions, template strings, documentation, or expected local operations. Four findings confirm unsafe report output or report-supplied paths, allowing external file overwrites through symlinks or a tampered report. A separate semantic finding identifies symlink traversal during scanning; no evidence found of malicious intent, prompt injection, credential collection, or network transmission.

Fichiers analysés

1,438

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Moyen

scripts/token-check.mjs:97-109

Symlinks Can Expand Scan Scope

The scanner follows symlinks with statSync and recurses without realpath containment or cycle detection. A repository link can expose external source literals in reports or cause recursive resource exhaustion.

statSync follows links, and walk recursively processes targets without checking real paths or visited directories. The implementation directly permits scope escape and directory cycles.

Éléments d’évaluation des capacités (4)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

scripts/token-check.mjs:231

Synchronous file operations

writeFileSync(join(cwd, file), lines.join("\n"))

Fix writes report-selected file paths without checking project containment. A tampered report can replace matching text in writable files outside the project.

Moyen

scripts/token-check.mjs:193

Synchronous file operations

writeFileSync(OUT, JSON.stringify({ scanned: list.length, tokens: TOKENS.source, findings }, null, 2

writeFileSync follows existing symlinks at the report file or directory without checking the real target. An attacker-controlled project can redirect report output to overwrite an external writable file.

Moyen

scripts/token-check.mjs:202

Synchronous file operations

const data = JSON.parse(readFileSync(OUT, "utf8"))

Fix loads editable report findings without validating paths or binding them to the original scan. A tampered report controls downstream file targets and replacements.

Moyen

scripts/token-check.mjs:220

Synchronous file operations

const lines = readFileSync(join(cwd, file), "utf8").split("\n")

The file path comes from report findings and is joined with cwd without containment checks. Parent-directory traversal can read files outside the project.

Facteurs de risque

🌐 Accès réseau (1)

package.json:17

⚙️ Commandes externes (48)

⚡ Contient des scripts (4)

scripts/token-check.mjs:28 scripts/token-check.mjs:35 scripts/token-check.mjs:40 scripts/token-check.mjs:47

📁 Accès au système de fichiers (19)

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-token-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

wunder-ui. (2026). wunderui-token-check security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1

Citation BibTeX

@techreport{wunder-ui-wunder-ui-wunderui-token-check-2026,
  author = {wunder-ui},
  title = {wunderui-token-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-token-check security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-token-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Clean Up Component Styles

Compare component literals with WunderUI tokens and review supported replacements before editing source.

Review Token Coverage

Group distant values and decide whether each needs an existing semantic token, a new token, or an explicit exception.

Prepare Theme Changes

Inspect fixed colors and suggested light and dark values before planning a theming migration.

Essayez ces prompts

Inspect Without Editing

Check my trusted WunderUI project for hardcoded colors, spacing, and radii. Inspect symlinks before scanning. Summarize findings without changing source files.

Review One Component

Scan this component and explain its nearest tokens and measured differences. Compare suggested light and dark values. Do not apply replacements until I approve.

Apply Approved Matches

Generate a fresh report for these trusted source folders. Show the proposed swap replacements and wait for approval. Then apply them, rescan, and run project checks.

Plan a Theme Migration

Group review findings by value and semantic role. Recommend mappings or exceptions, including dark-mode effects. Propose explicit selections for approval and identify manual spacing edits.

Bonnes pratiques

Use a clean version-control checkpoint, trusted source folders, and a freshly generated report; inspect symlinks and report targets before fixing.
Approve replacements by semantic role and inspect both theme modes rather than relying only on measured distance.
Rescan after edits, review the diff, run project checks, and inspect affected components visually.

Éviter

Running fix against a supplied or tampered report without checking its paths and replacements.
Treating low color distance as proof of accessibility, transparency preservation, or identical dark-mode behavior.
Replacing every review finding automatically or changing artwork and brand colors without a design decision.

Foire aux questions

Which assistants can use this skill?

The report lists Claude, Codex, and Claude Code. Running the bundled scanner requires an environment that can execute local Node.js commands.

What must my project provide?

Use Node.js 20 or later and a WunderUI project with the corresponding tokens available. The script has no package dependencies.

What do swap, visible, and review mean?

Swap means color distance at most 2 or an exact dimension match. Visible allows distance at most 6 or 2 pixels. Review needs a design decision.

Does it rewrite every finding?

No. Default fix selects swap findings; visible findings require an option. CSS spacing declarations and unsupported inline dimensions need manual edits.

Does it send project data to a service?

No network transmission was found in the reviewed files. The script reads local source and writes a local report.

What security precautions are necessary?

Fix does not validate report paths, and scanning follows symlinks. Use trusted projects, regenerate reports, inspect targets, and keep recoverable source changes.