📦

oil-ui

Name: oil-ui
Author: oil-oil

v0.15.5 Ревизия содержимого r2 Высокий риск ⚡ Содержит скрипты⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе🔑 Переменные окружения

Explore and Refine Interface Designs

Interface projects often need clear visual direction before implementation. Oil UI guides design exploration, preview comparison, and evidence-based refinement.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "oil-ui" from https://skillstore.io/skills/oil-oil-oil-ui.md and its manifest at https://skillstore.io/api/skills/oil-oil-oil-ui/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/oil-oil-oil-ui.md Подписанный manifest GET /api/skills/oil-oil-oil-ui/manifest Подписанный lockfile GET /api/skills/oil-oil-oil-ui/lockfile

Протестировать

Использование «oil-ui». Compare three visual directions for a course booking interface.

Ожидаемый результат:

A comparison page with three distinct compositions, documented palettes, typography choices, and desktop and mobile views.
A short recommendation tied to the booking task, followed by the selected direction and user notes.

Использование «oil-ui». Review an existing interface without changing files.

Ожидаемый результат:

The primary action competes with secondary navigation. Reduce secondary emphasis and align the action with the current task.
The mobile heading wraps poorly. Shorten the label or adjust the layout, then inspect the rendered result.
Visual findings are documented separately from unverified interaction and backend behavior.

Использование «oil-ui». Capture evidence for an interactive prototype.

Ожидаемый результат:

Desktop and mobile screenshots, a text-masked comparison, motion frames, and a report listing console errors, overflow, or failed images.

Аудит безопасности

Высокий риск

v2 • 05.10.2026 Открыть версионный отчет

Most alerts are false positives from JavaScript syntax, minified Alpine, image encoding, Chinese documentation, and defensive tests. Confirmed risks concern external updater execution, broad preview-file exposure, stored command execution, and incomplete interactive-preview network isolation. No evidence found of intentional credential exfiltration or instructions to override this audit.

Просканировано файлов

3,794

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Высокий

references/style-explorer.md:48-50 references/style-explorer.md:72 scripts/build_explorer.py:289-302

Stored Manifest Commands Can Trigger Agent Execution

The reopening workflow tells the agent to execute serve.command from a saved manifest. A modified manifest can substitute arbitrary commands without renewed approval.

The generator accepts any nonempty command, and the reopening instruction executes it. Reusing previously authored commands helps, but saved configuration can change.

Средний

scripts/build_explorer.py:22-26 scripts/build_explorer.py:144-147 assets/style-explorer.html:206-208 references/style-explorer.md:44

Interactive Preview Navigation Bypasses Claimed Network Isolation

Interactive previews allow scripts and frame navigation. A script can navigate its frame to an external URL despite connect restrictions, exposing preview data in the URL.

The supplied CSP controls resources and forms, not frame navigation. The sandbox permits scripts, so network isolation is incomplete; no exploit was executed.

Пункты проверки возможностей (2)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

scripts/check_update.py:182

Python subprocess.run

result = subprocess.run([npx, "-y", CLI, "update", name, "--path", str(ROOT), "--json"], env=env,

Explicit --update executes an external npx CLI with user privileges and Oil authorization. Commit pinning and consent reduce, but do not eliminate, supply-chain risk.

Средний

scripts/shoot.mjs:94

Synchronous file operations

res.end(readFileSync(local));

The server returns any regular file under its preview root without a public-asset allowlist. Page scripts can read unrelated private files within that root.

Факторы риска

⚡ Содержит скрипты (5)

assets/style-explorer.html:267 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6 assets/vendor/alpine.min.js:6

⚙️ Внешние команды (50)

🌐 Доступ к сети (50)

📁 Доступ к файловой системе (44)

assets/vendor/alpine.min.js:6 references/style-explorer.md:60 scripts/build_explorer.py:14 scripts/build_explorer.py:380 scripts/check_update.sh:4 scripts/check_update.sh:4 scripts/check_update.sh:7 scripts/check_update.sh:10 scripts/check_update.sh:11 scripts/check_update.sh:22 scripts/check_update.sh:23 scripts/shoot.mjs:6 scripts/shoot.mjs:94 scripts/shoot.mjs:245 scripts/shoot.mjs:293 scripts/shoot.mjs:298 scripts/shoot.mjs:313 scripts/shoot.mjs:330 scripts/shoot.mjs:336 scripts/shoot.mjs:386 scripts/shoot.mjs:59 scripts/shoot.mjs:79 scripts/shoot.mjs:6 scripts/shoot.mjs:128 SKILL.md:24 tests/test_build_explorer.py:136 tests/test_build_explorer.py:175 tests/test_build_explorer.py:232 tests/test_build_explorer.py:13 tests/test_build_explorer.py:25 tests/test_build_explorer.py:357 tests/test_build_explorer.py:358 tests/test_check_update.py:6 tests/test_check_update.py:66 tests/test_check_update.py:69 tests/test_check_update.py:70 tests/test_check_update.py:84 tests/test_check_update.py:206 tests/test_check_update.py:285 tests/test_shoot.py:171 tests/test_shoot.py:192 tests/test_shoot.py:9 tests/test_shoot.py:99 tests/test_shoot.py:166

🔑 Переменные окружения (34)

Аудитор:: codex Посмотреть историю аудитов →

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/oil-oil-oil-ui/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg)](https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/oil-oil-oil-ui?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oil-oil-oil-ui/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/oil-oil-oil-ui.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

oil-oil. (2026). oil-ui security audit report (audit version 2) [Author version 0.15.5]. Skillstore. https://skillstore.io/skills/oil-oil-oil-ui/audits/2

Цитата BibTeX

@techreport{oil-oil-oil-oil-oil-ui-2026,
  author = {oil-oil},
  title = {oil-ui security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/oil-oil-oil-ui/audits/2},
  note = {Author version 0.15.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "oil-ui security audit report (audit version 2)"
version: "0.15.5"
type: report
authors:
  - name: "oil-oil"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/oil-oil-oil-ui/audits/2"
identifiers:
  - type: other
    value: "skillstore:oil-oil-oil-ui:audit:2"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

100

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Choose a Product Direction

Compare distinct interface directions before selecting typography, imagery, and composition for implementation.

Refine an Existing Interface

Improve hierarchy and spacing while preserving established brand assets, components, and project conventions.

Review a Proposed Experience

Inspect desktop and mobile evidence, record visible problems, and prioritize changes without modifying project files.

Попробуйте эти промпты

Review One Screen

Review this screen for hierarchy, spacing, typography, and readability. Keep files unchanged and distinguish visible defects from style preferences.

Compare Design Directions

Explore three distinct directions for this product. Keep the audience, content, and main action consistent, then create a comparison page.

Recreate a Reference

Recreate this reference at its documented viewport. Add a mobile layout and label assumptions where the reference does not show behavior.

Refine and Verify a Workflow

Refine this workflow using existing components. Capture key states and motion evidence, request an independent visual review, and report remaining gaps.

Лучшие практики

Define the audience, main action, actual content, target viewport, and deliverable before exploring directions.
Inspect actual-size desktop and mobile renders; record unverified behavior and keep screenshots tied to the current version.
Use trusted candidates in a dedicated preview directory, approve saved commands, and authorize updates separately.

Избегать

Treating a static screenshot or scaled preview as proof of working interaction or mobile reflow.
Executing stored manifest commands or external updates without reviewing their source and scope.
Previewing untrusted scripts beside private files or claiming interactive previews cannot make external requests.

Часто задаваемые вопросы

Which assistants can use this skill?

The workflow supports Claude, Codex, and Claude Code. Optional generation and capture depend on the host environment.

Does it produce working interfaces?

It can guide implementation and prototypes, but business logic and comprehensive code correctness remain outside its stated scope.

Can comparison pages work offline?

Embedded static HTML and image candidates are portable. Live candidates need a local server; interactive scripts do not guarantee complete network isolation.

What does screenshot capture require?

The bundled tool needs Node.js 22+ and Chrome, Chromium, or Edge. Video assembly additionally needs ffmpeg.

Does it update automatically?

Default checks only read public version information. Explicit --update approval runs a pinned external CLI that can replace the installation.

Can it review an interface without editing files?

Yes. Review-only requests remain read-only, and independent visual review requires an isolated reviewer that can inspect images.