스킬 wunderui-setup

📦

wunderui-setup

Name: wunderui-setup
Author: wunder-ui

콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근⚡ 스크립트 포함⚙️ 외부 명령어📁 파일 시스템 접근

Set Up WunderUI in Your React Project

WunderUI components can appear unstyled when package installation, Tailwind scanning, or token precedence is incomplete. This skill coordinates setup, creates a verification component, and documents remaining checks.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "wunderui-setup" from https://skillstore.io/skills/wunder-ui-wunderui-setup.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/wunder-ui-wunderui-setup.md 서명된 manifest GET /api/skills/wunder-ui-wunderui-setup/manifest 서명된 lockfile GET /api/skills/wunder-ui-wunderui-setup/lockfile

테스트해 보기

"wunderui-setup" 사용 중입니다. Check whether my Tailwind v3 project is ready for WunderUI.

예상 결과:

Readiness: Tailwind v3 does not meet the supported styling requirement.
Next action: approve a Tailwind v4 upgrade before continuing setup.
Verification: a styled WunderUI probe remains pending.

"wunderui-setup" 사용 중입니다. Summarize setup after creating the probe and registering MCP.

예상 결과:

Setup report: lists the detected framework, CSS entry, package information, and recorded changes.
Browser check: confirm the probe button background is not transparent.
MCP check: restart the editor and call get_library_info.
Remaining work: confirm token precedence before building the first screen.

보안 감사

높은 위험

v1 • 2026. 10. 10. 버전별 보고서 열기

Most static alerts are formatting, regular expression matching, or expected project file access. Confirmed command execution risks include shell interpolation of checkout paths and npm output. Additional risks include unverified persistent agent rules, an unpinned MCP launcher, and package execution during checkout dry runs; no malicious payload was found.

스캔된 파일

366

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (3)

높음

scripts/setup.mjs:105-123 SKILL.md:25

Unverified References Become Persistent Agent Instructions

The helper fetches mutable instruction files and inserts their contents into CLAUDE.md or AGENTS.md. Compromised references could persistently redirect future agent behavior.

The download-to-rules pipeline has no integrity verification or content approval step. No malicious instruction payload was found in the audited files.

중간

scripts/setup.mjs:12 scripts/setup.mjs:139-148

Checkout Dry Runs Execute Package Operations

Despite the documented write-free --dry option, checkout installation creates .wunderui and executes npm pack before checking DRY. Package lifecycle scripts can run during preview.

Directory creation and execSync precede the DRY guard unconditionally in the checkout branch. npm pack can run lifecycle hooks unless scripts are disabled.

중간

scripts/setup.mjs:155-170 SKILL.md:28-31

Unpinned MCP Package Executes Through Agent Configuration

Without a local MCP entrypoint, generated editor configuration launches npx -y wunderui-mcp without a version pin. A changed registry release can execute when loaded.

The generated command accepts automatic package retrieval and specifies no reviewed version. No malicious package release or actual execution was observed.

기능 검토 항목 (4)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

scripts/setup.mjs:144

Synchronous process execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

execSync interpolates checkout and project paths into a shell command. Double quotes do not prevent command substitution in crafted paths.

높음

scripts/setup.mjs:149

Synchronous process execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

The checkout branch constructs target from npm pack output and passes it unquoted to a shell. Crafted archive names can alter shell parsing.

높음

scripts/setup.mjs:144

Ruby/shell backtick execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

Although the syntax is JavaScript, this string is passed directly to execSync. Crafted paths can trigger shell command substitution.

높음

scripts/setup.mjs:149

Ruby/shell backtick execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

This template literal actually enters execSync, unlike ordinary string formatting. The unquoted target derived from npm output creates shell parsing risk.

위험 요인

🌐 네트워크 접근 (5)

package.json:17 scripts/setup.mjs:108 scripts/setup.mjs:108 scripts/setup.mjs:109 SKILL.md:25

⚡ 스크립트 포함 (1)

scripts/setup.mjs:189

⚙️ 외부 명령어 (47)

📁 파일 시스템 접근 (17)

scripts/setup.mjs:13 scripts/setup.mjs:24 scripts/setup.mjs:26 scripts/setup.mjs:29 scripts/setup.mjs:65 scripts/setup.mjs:68 scripts/setup.mjs:113 scripts/setup.mjs:117 scripts/setup.mjs:180 scripts/setup.mjs:252 scripts/setup.mjs:65 scripts/setup.mjs:145 scripts/setup.mjs:186 scripts/setup.mjs:187 scripts/setup.mjs:189 scripts/setup.mjs:196 scripts/setup.mjs:205

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

wunder-ui. (2026). wunderui-setup security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1

BibTeX 인용

@techreport{wunder-ui-wunder-ui-wunderui-setup-2026,
  author = {wunder-ui},
  title = {wunderui-setup security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-setup security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-setup:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Configure a New React Interface

Add WunderUI to an existing React project and inspect a small component probe before building application screens.

Resolve Unstyled Components

Check Tailwind source scanning, stylesheet imports, and token precedence when existing WunderUI components render without expected styles.

Standardize Team Setup

Review design references and MCP configuration, then document project prerequisites and pending verification for a team handoff.

이 프롬프트를 사용해 보세요

Inspect Prerequisites

Inspect my React project with WunderUI detection in dry mode. Identify the framework, Tailwind version, and CSS entry without installing packages.

Set Up With Approval

Set up WunderUI for my Free plan. Ask before installation or edits, and show downloaded agent instructions for review before inserting them.

Diagnose Styling Problems

Diagnose why my WunderUI buttons are unstyled. Check the Tailwind source path and stylesheet order, preserve my tokens, and verify the probe.

Review a Local Checkout

Review my built WunderUI checkout before setup. Check shell arguments, lifecycle scripts, and MCP version trust; require approval before execution and report remaining checks.

모범 사례

Review dependency sources, lifecycle scripts, downloaded rules, and the MCP launcher before approving execution.
Run detection first, confirm Tailwind v4, and agree on token precedence before editing the CSS entry.
Keep a recoverable project snapshot, inspect changes, and verify both the probe rendering and MCP availability.

피하기

Treating --dry checkout installation as a guarantee that no subprocesses run or files change.
Automatically trusting downloaded instruction files or an unpinned MCP package.
Removing project token overrides or declaring setup complete without consent and browser verification.