📦

oil-ui

v0.15.5 Revisão do conteúdo r2 Risco alto ⚡ Contém scripts⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente

Explore and Refine Interface Designs

Interface projects often need clear visual direction before implementation. Oil UI guides design exploration, preview comparison, and evidence-based refinement.

Suporta: Claude Codex Code(CC)
⚠️ 38 Ruim

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente
Review the Skillstore skill "oil-ui" from https://skillstore.io/skills/oil-oil-oil-ui.md and its manifest at https://skillstore.io/api/skills/oil-oil-oil-ui/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Testar

Usando "oil-ui". Compare three visual directions for a course booking interface.

Resultado esperado:

  • A comparison page with three distinct compositions, documented palettes, typography choices, and desktop and mobile views.
  • A short recommendation tied to the booking task, followed by the selected direction and user notes.

Usando "oil-ui". Review an existing interface without changing files.

Resultado esperado:

  • The primary action competes with secondary navigation. Reduce secondary emphasis and align the action with the current task.
  • The mobile heading wraps poorly. Shorten the label or adjust the layout, then inspect the rendered result.
  • Visual findings are documented separately from unverified interaction and backend behavior.

Usando "oil-ui". Capture evidence for an interactive prototype.

Resultado esperado:

Desktop and mobile screenshots, a text-masked comparison, motion frames, and a report listing console errors, overflow, or failed images.

Auditoria de segurança

Risco alto

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

24
Arquivos analisados
3,794
Linhas analisadas
2
Itens de revisão
0
Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto
Stored Manifest Commands Can Trigger Agent Execution
The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.
The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.
Médio
Interactive Preview Navigation Bypasses Claimed Network Isolation
Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.
The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.
Itens de revisão de capacidade (2)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto
Python subprocess.run
result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,
Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.
Médio
Synchronous file operations
res.end(readFileSync(local));
The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

Fatores de risco

⚡ Contém scripts (5)
⚙️ Comandos externos (50)
assets/style-explorer.html:144 assets/style-explorer.html:145 assets/style-explorer.html:147 assets/style-explorer.html:154 assets/style-explorer.html:189 assets/style-explorer.html:195-218 assets/style-explorer.html:218 assets/style-explorer.html:230-232 assets/style-explorer.html:232-233 assets/style-explorer.html:233-254 assets/style-explorer.html:254-270 assets/style-explorer.html:270 assets/style-explorer.html:272-286 assets/style-explorer.html:286-298 assets/style-explorer.html:298-308 assets/style-explorer.html:308-314 assets/style-explorer.html:314-324 assets/style-explorer.html:324-329 assets/style-explorer.html:329 assets/style-explorer.html:143 assets/style-explorer.html:174 assets/style-explorer.html:192 assets/style-explorer.html:193 assets/style-explorer.html:196 assets/style-explorer.html:197 assets/style-explorer.html:220 assets/style-explorer.html:237 assets/style-explorer.html:240 assets/style-explorer.html:248 assets/style-explorer.html:249 assets/style-explorer.html:252 assets/style-explorer.html:256 assets/style-explorer.html:257 assets/style-explorer.html:258 assets/style-explorer.html:260 assets/style-explorer.html:264 assets/style-explorer.html:275 assets/style-explorer.html:280 assets/style-explorer.html:282 assets/style-explorer.html:283 assets/style-explorer.html:285 assets/style-explorer.html:286 assets/style-explorer.html:287 assets/style-explorer.html:298 assets/style-explorer.html:308 assets/style-explorer.html:314 assets/style-explorer.html:315 assets/style-explorer.html:316 assets/style-explorer.html:321 assets/style-explorer.html:322
🌐 Acesso à rede (50)
📁 Acesso ao sistema de arquivos (44)
🔑 Variáveis de ambiente (34)
Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado
Avaliação de Segurança

Copiar link do relatório

https://skillstore.io/skills/oil-oil-oil-ui/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg)](https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/oil-oil-oil-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

oil-oil. (2026). oil-ui security audit report (audit version 2) [Author version 0.15.5]. Skillstore. https://skillstore.io/skills/oil-oil-oil-ui/audits/2

Citação BibTeX

@techreport{oil-oil-oil-oil-oil-ui-2026, author = {oil-oil}, title = {oil-ui security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/oil-oil-oil-ui/audits/2}, note = {Author version 0.15.5} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "oil-ui security audit report (audit version 2)" version: "0.15.5" type: report authors: - name: "oil-oil" date-released: "2026-10-05" url: "https://skillstore.io/skills/oil-oil-oil-ui/audits/2" identifiers: - type: other value: "skillstore:oil-oil-oil-ui:audit:2" description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio
95
Arquitetura
100
Manutenibilidade
87
Conteúdo
65
Comunidade
91
Conformidade com a especificação

O que você pode criar

Choose a Product Direction

Compare distinct interface directions before selecting typography, imagery, and composition for implementation.

Refine an Existing Interface

Improve hierarchy and spacing while preserving established brand assets, components, and project conventions.

Review a Proposed Experience

Inspect desktop and mobile evidence, record visible problems, and prioritize changes without modifying project files.

Teste estes prompts

Review One Screen
Review this screen for hierarchy, spacing, typography, and readability. Keep files unchanged and distinguish visible defects from style preferences.
Compare Design Directions
Explore three distinct directions for this product. Keep the audience, content, and main action consistent, then create a comparison page.
Recreate a Reference
Recreate this reference at its documented viewport. Add a mobile layout and label assumptions where the reference does not show behavior.
Refine and Verify a Workflow
Refine this workflow using existing components. Capture key states and motion evidence, request an independent visual review, and report remaining gaps.

Boas práticas

  • Define the audience, main action, actual content, target viewport, and deliverable before exploring directions.
  • Inspect actual-size desktop and mobile renders; record unverified behavior and keep screenshots tied to the current version.
  • Use trusted candidates in a dedicated preview directory, approve saved commands, and authorize updates separately.

Evitar

  • Treating a static screenshot or scaled preview as proof of working interaction or mobile reflow.
  • Executing stored manifest commands or external updates without reviewing their source and scope.
  • Previewing untrusted scripts beside private files or claiming interactive previews cannot make external requests.

Perguntas frequentes

Which assistants can use this skill?
The workflow supports Claude, Codex, and Claude Code. Optional generation and capture depend on the host environment.
Does it produce working interfaces?
It can guide implementation and prototypes, but business logic and comprehensive code correctness remain outside its stated scope.
Can comparison pages work offline?
Embedded static HTML and image candidates are portable. Live candidates need a local server; interactive scripts do not guarantee complete network isolation.
What does screenshot capture require?
The bundled tool needs Node.js 22+ and Chrome, Chromium, or Edge. Video assembly additionally needs ffmpeg.
Does it update automatically?
Default checks only read public version information. Explicit --update approval runs a pinned external CLI that can replace the installation.
Can it review an interface without editing files?
Yes. Review-only requests remain read-only, and independent visual review requires an isolated reviewer that can inspect images.

Detalhes do desenvolvedor

Autor

oil-oil

Licença

MIT

Versão do autor

v0.15.5

Revisão da Skillstore

r2

Referência

47f59dc55cb81458b6e112128ee16cf32ef77f31

Atualidade da manutenção

06/10/2026

Uso

10 downloads · 0 visualizações

Ver tudo