📦

oil-ui

Name: oil-ui
Author: oil-oil

v0.15.5 콘텐츠 리비전 r2 높은 위험 ⚡ 스크립트 포함⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수

Explore and Refine Interface Designs

Interface projects often need clear visual direction before implementation. Oil UI guides design exploration, preview comparison, and evidence-based refinement.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "oil-ui" from https://skillstore.io/skills/oil-oil-oil-ui.md and its manifest at https://skillstore.io/api/skills/oil-oil-oil-ui/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/oil-oil-oil-ui.md 서명된 manifest GET /api/skills/oil-oil-oil-ui/manifest 서명된 lockfile GET /api/skills/oil-oil-oil-ui/lockfile

테스트해 보기

"oil-ui" 사용 중입니다. Compare three visual directions for a course booking interface.

예상 결과:

A comparison page with three distinct compositions, documented palettes, typography choices, and desktop and mobile views.
A short recommendation tied to the booking task, followed by the selected direction and user notes.

"oil-ui" 사용 중입니다. Review an existing interface without changing files.

예상 결과:

The primary action competes with secondary navigation. Reduce secondary emphasis and align the action with the current task.
The mobile heading wraps poorly. Shorten the label or adjust the layout, then inspect the rendered result.
Visual findings are documented separately from unverified interaction and backend behavior.

"oil-ui" 사용 중입니다. Capture evidence for an interactive prototype.

예상 결과:

Desktop and mobile screenshots, a text-masked comparison, motion frames, and a report listing console errors, overflow, or failed images.

보안 감사

높은 위험

v2 • 2026. 10. 5. 버전별 보고서 열기

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

스캔된 파일

3,794

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

높음

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

중간

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

기능 검토 항목 (2)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

중간

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

위험 요인

⚡ 스크립트 포함 (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ 외부 명령어 (50)

🌐 네트워크 접근 (50)

📁 파일 시스템 접근 (44)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166

🔑 환경 변수 (34)

감사자: codex 감사 이력 보기 →

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/oil-oil-oil-ui/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg)](https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/oil-oil-oil-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

oil-oil. (2026). oil-ui security audit report (audit version 2) [Author version 0.15.5]. Skillstore. https://skillstore.io/skills/oil-oil-oil-ui/audits/2

BibTeX 인용

@techreport{oil-oil-oil-oil-oil-ui-2026,
  author = {oil-oil},
  title = {oil-ui security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/oil-oil-oil-ui/audits/2},
  note = {Author version 0.15.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "oil-ui security audit report (audit version 2)"
version: "0.15.5"
type: report
authors:
  - name: "oil-oil"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/oil-oil-oil-ui/audits/2"
identifiers:
  - type: other
    value: "skillstore:oil-oil-oil-ui:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Choose a Product Direction

Compare distinct interface directions before selecting typography, imagery, and composition for implementation.

Refine an Existing Interface

Improve hierarchy and spacing while preserving established brand assets, components, and project conventions.

Review a Proposed Experience

Inspect desktop and mobile evidence, record visible problems, and prioritize changes without modifying project files.

이 프롬프트를 사용해 보세요

Review One Screen

Review this screen for hierarchy, spacing, typography, and readability. Keep files unchanged and distinguish visible defects from style preferences.

Compare Design Directions

Explore three distinct directions for this product. Keep the audience, content, and main action consistent, then create a comparison page.

Recreate a Reference

Recreate this reference at its documented viewport. Add a mobile layout and label assumptions where the reference does not show behavior.

Refine and Verify a Workflow

Refine this workflow using existing components. Capture key states and motion evidence, request an independent visual review, and report remaining gaps.

모범 사례

Define the audience, main action, actual content, target viewport, and deliverable before exploring directions.
Inspect actual-size desktop and mobile renders; record unverified behavior and keep screenshots tied to the current version.
Use trusted candidates in a dedicated preview directory, approve saved commands, and authorize updates separately.

피하기

Treating a static screenshot or scaled preview as proof of working interaction or mobile reflow.
Executing stored manifest commands or external updates without reviewing their source and scope.
Previewing untrusted scripts beside private files or claiming interactive previews cannot make external requests.

자주 묻는 질문

Which assistants can use this skill?

The workflow supports Claude, Codex, and Claude Code. Optional generation and capture depend on the host environment.

Does it produce working interfaces?

It can guide implementation and prototypes, but business logic and comprehensive code correctness remain outside its stated scope.

Can comparison pages work offline?

Embedded static HTML and image candidates are portable. Live candidates need a local server; interactive scripts do not guarantee complete network isolation.

What does screenshot capture require?

The bundled tool needs Node.js 22+ and Chrome, Chromium, or Edge. Video assembly additionally needs ffmpeg.

Does it update automatically?

Default checks only read public version information. Explicit --update approval runs a pinned external CLI that can replace the installation.

Can it review an interface without editing files?

Yes. Review-only requests remain read-only, and independent visual review requires an isolated reviewer that can inspect images.