📦

wunderui-setup

Name: wunderui-setup
Author: wunder-ui

Ревизия содержимого r1 Высокий риск 🌐 Доступ к сети⚡ Содержит скрипты⚙️ Внешние команды📁 Доступ к файловой системе

Set Up WunderUI in Your React Project

WunderUI components can appear unstyled when package installation, Tailwind scanning, or token precedence is incomplete. This skill coordinates setup, creates a verification component, and documents remaining checks.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "wunderui-setup" from https://skillstore.io/skills/wunder-ui-wunderui-setup.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/wunder-ui-wunderui-setup.md Подписанный manifest GET /api/skills/wunder-ui-wunderui-setup/manifest Подписанный lockfile GET /api/skills/wunder-ui-wunderui-setup/lockfile

Протестировать

Использование «wunderui-setup». Check whether my Tailwind v3 project is ready for WunderUI.

Ожидаемый результат:

Readiness: Tailwind v3 does not meet the supported styling requirement.
Next action: approve a Tailwind v4 upgrade before continuing setup.
Verification: a styled WunderUI probe remains pending.

Использование «wunderui-setup». Summarize setup after creating the probe and registering MCP.

Ожидаемый результат:

Setup report: lists the detected framework, CSS entry, package information, and recorded changes.
Browser check: confirm the probe button background is not transparent.
MCP check: restart the editor and call get_library_info.
Remaining work: confirm token precedence before building the first screen.

Аудит безопасности

Высокий риск

v1 • 10.10.2026 Открыть версионный отчет

Most static alerts are formatting, regular expression matching, or expected project file access. Confirmed command execution risks include shell interpolation of checkout paths and npm output. Additional risks include unverified persistent agent rules, an unpinned MCP launcher, and package execution during checkout dry runs; no malicious payload was found.

Просканировано файлов

366

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (3)

Высокий

scripts/setup.mjs:105-123 SKILL.md:25

Unverified References Become Persistent Agent Instructions

The helper fetches mutable instruction files and inserts their contents into CLAUDE.md or AGENTS.md. Compromised references could persistently redirect future agent behavior.

The download-to-rules pipeline has no integrity verification or content approval step. No malicious instruction payload was found in the audited files.

Средний

scripts/setup.mjs:12 scripts/setup.mjs:139-148

Checkout Dry Runs Execute Package Operations

Despite the documented write-free --dry option, checkout installation creates .wunderui and executes npm pack before checking DRY. Package lifecycle scripts can run during preview.

Directory creation and execSync precede the DRY guard unconditionally in the checkout branch. npm pack can run lifecycle hooks unless scripts are disabled.

Средний

scripts/setup.mjs:155-170 SKILL.md:28-31

Unpinned MCP Package Executes Through Agent Configuration

Without a local MCP entrypoint, generated editor configuration launches npx -y wunderui-mcp without a version pin. A changed registry release can execute when loaded.

The generated command accepts automatic package retrieval and specifies no reviewed version. No malicious package release or actual execution was observed.

Пункты проверки возможностей (4)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

scripts/setup.mjs:144

Synchronous process execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

execSync interpolates checkout and project paths into a shell command. Double quotes do not prevent command substitution in crafted paths.

Высокий

scripts/setup.mjs:149

Synchronous process execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

The checkout branch constructs target from npm pack output and passes it unquoted to a shell. Crafted archive names can alter shell parsing.

Высокий

scripts/setup.mjs:144

Ruby/shell backtick execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

Although the syntax is JavaScript, this string is passed directly to execSync. Crafted paths can trigger shell command substitution.

Высокий

scripts/setup.mjs:149

Ruby/shell backtick execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

This template literal actually enters execSync, unlike ordinary string formatting. The unquoted target derived from npm output creates shell parsing risk.

Факторы риска

🌐 Доступ к сети (5)

package.json:17 scripts/setup.mjs:108 scripts/setup.mjs:108 scripts/setup.mjs:109 SKILL.md:25

⚡ Содержит скрипты (1)

scripts/setup.mjs:189

⚙️ Внешние команды (47)

📁 Доступ к файловой системе (17)

scripts/setup.mjs:13 scripts/setup.mjs:24 scripts/setup.mjs:26 scripts/setup.mjs:29 scripts/setup.mjs:65 scripts/setup.mjs:68 scripts/setup.mjs:113 scripts/setup.mjs:117 scripts/setup.mjs:180 scripts/setup.mjs:252 scripts/setup.mjs:65 scripts/setup.mjs:145 scripts/setup.mjs:186 scripts/setup.mjs:187 scripts/setup.mjs:189 scripts/setup.mjs:196 scripts/setup.mjs:205

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

wunder-ui. (2026). wunderui-setup security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1

Цитата BibTeX

@techreport{wunder-ui-wunder-ui-wunderui-setup-2026,
  author = {wunder-ui},
  title = {wunderui-setup security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-setup security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-setup:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Configure a New React Interface

Add WunderUI to an existing React project and inspect a small component probe before building application screens.

Resolve Unstyled Components

Check Tailwind source scanning, stylesheet imports, and token precedence when existing WunderUI components render without expected styles.

Standardize Team Setup

Review design references and MCP configuration, then document project prerequisites and pending verification for a team handoff.

Попробуйте эти промпты

Inspect Prerequisites

Inspect my React project with WunderUI detection in dry mode. Identify the framework, Tailwind version, and CSS entry without installing packages.

Set Up With Approval

Set up WunderUI for my Free plan. Ask before installation or edits, and show downloaded agent instructions for review before inserting them.

Diagnose Styling Problems

Diagnose why my WunderUI buttons are unstyled. Check the Tailwind source path and stylesheet order, preserve my tokens, and verify the probe.

Review a Local Checkout

Review my built WunderUI checkout before setup. Check shell arguments, lifecycle scripts, and MCP version trust; require approval before execution and report remaining checks.

Лучшие практики

Review dependency sources, lifecycle scripts, downloaded rules, and the MCP launcher before approving execution.
Run detection first, confirm Tailwind v4, and agree on token precedence before editing the CSS entry.
Keep a recoverable project snapshot, inspect changes, and verify both the probe rendering and MCP availability.

Избегать

Treating --dry checkout installation as a guarantee that no subprocesses run or files change.
Automatically trusting downloaded instruction files or an unpinned MCP package.
Removing project token overrides or declaring setup complete without consent and browser verification.