スキル wunderui-setup

📦

wunderui-setup

Name: wunderui-setup
Author: wunder-ui

コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス⚡ スクリプトを含む⚙️ 外部コマンド📁 ファイルシステムへのアクセス

Set Up WunderUI in Your React Project

WunderUI components can appear unstyled when package installation, Tailwind scanning, or token precedence is incomplete. This skill coordinates setup, creates a verification component, and documents remaining checks.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

Maintain this Skill? Claim it ⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "wunderui-setup" from https://skillstore.io/skills/wunder-ui-wunderui-setup.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/wunder-ui-wunderui-setup.md 署名済み manifest GET /api/skills/wunder-ui-wunderui-setup/manifest 署名済み lockfile GET /api/skills/wunder-ui-wunderui-setup/lockfile

テストする

「wunderui-setup」を使用しています。 Check whether my Tailwind v3 project is ready for WunderUI.

期待される結果:

Readiness: Tailwind v3 does not meet the supported styling requirement.
Next action: approve a Tailwind v4 upgrade before continuing setup.
Verification: a styled WunderUI probe remains pending.

「wunderui-setup」を使用しています。 Summarize setup after creating the probe and registering MCP.

期待される結果:

Setup report: lists the detected framework, CSS entry, package information, and recorded changes.
Browser check: confirm the probe button background is not transparent.
MCP check: restart the editor and call get_library_info.
Remaining work: confirm token precedence before building the first screen.

セキュリティ監査

高リスク

v1 • 2026/10/10 バージョン別レポートを開く

Most static alerts are formatting, regular expression matching, or expected project file access. Confirmed command execution risks include shell interpolation of checkout paths and npm output. Additional risks include unverified persistent agent rules, an unpinned MCP launcher, and package execution during checkout dry runs; no malicious payload was found.

スキャンされたファイル

366

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (3)

高

scripts/setup.mjs:105-123 SKILL.md:25

Unverified References Become Persistent Agent Instructions

The helper fetches mutable instruction files and inserts their contents into CLAUDE.md or AGENTS.md. Compromised references could persistently redirect future agent behavior.

The download-to-rules pipeline has no integrity verification or content approval step. No malicious instruction payload was found in the audited files.

中

scripts/setup.mjs:12 scripts/setup.mjs:139-148

Checkout Dry Runs Execute Package Operations

Despite the documented write-free --dry option, checkout installation creates .wunderui and executes npm pack before checking DRY. Package lifecycle scripts can run during preview.

Directory creation and execSync precede the DRY guard unconditionally in the checkout branch. npm pack can run lifecycle hooks unless scripts are disabled.

中

scripts/setup.mjs:155-170 SKILL.md:28-31

Unpinned MCP Package Executes Through Agent Configuration

Without a local MCP entrypoint, generated editor configuration launches npx -y wunderui-mcp without a version pin. A changed registry release can execute when loaded.

The generated command accepts automatic package retrieval and specifies no reviewed version. No malicious package release or actual execution was observed.

機能レビュー項目 (4)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

scripts/setup.mjs:144

Synchronous process execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

execSync interpolates checkout and project paths into a shell command. Double quotes do not prevent command substitution in crafted paths.

高

scripts/setup.mjs:149

Synchronous process execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

The checkout branch constructs target from npm pack output and passes it unquoted to a shell. Crafted archive names can alter shell parsing.

高

scripts/setup.mjs:144

Ruby/shell backtick execution

const packed = execSync(`npm pack "${pkgDir}" --pack-destination "${out}" --silent`, { cwd, encoding

Although the syntax is JavaScript, this string is passed directly to execSync. Crafted paths can trigger shell command substitution.

高

scripts/setup.mjs:149

Ruby/shell backtick execution

execSync(`npm install ${target}`, { cwd, stdio: "inherit" })

This template literal actually enters execSync, unlike ordinary string formatting. The unquoted target derived from npm output creates shell parsing risk.

リスク要因

🌐 ネットワークアクセス (5)

package.json:17 scripts/setup.mjs:108 scripts/setup.mjs:108 scripts/setup.mjs:109 SKILL.md:25

⚡ スクリプトを含む (1)

scripts/setup.mjs:189

⚙️ 外部コマンド (47)

📁 ファイルシステムへのアクセス (17)

scripts/setup.mjs:13 scripts/setup.mjs:24 scripts/setup.mjs:26 scripts/setup.mjs:29 scripts/setup.mjs:65 scripts/setup.mjs:68 scripts/setup.mjs:113 scripts/setup.mjs:117 scripts/setup.mjs:180 scripts/setup.mjs:252 scripts/setup.mjs:65 scripts/setup.mjs:145 scripts/setup.mjs:186 scripts/setup.mjs:187 scripts/setup.mjs:189 scripts/setup.mjs:196 scripts/setup.mjs:205

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/wunder-ui-wunderui-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

wunder-ui. (2026). wunderui-setup security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1

BibTeX形式の引用

@techreport{wunder-ui-wunder-ui-wunderui-setup-2026,
  author = {wunder-ui},
  title = {wunderui-setup security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-setup security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-setup/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-setup:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Configure a New React Interface

Add WunderUI to an existing React project and inspect a small component probe before building application screens.

Resolve Unstyled Components

Check Tailwind source scanning, stylesheet imports, and token precedence when existing WunderUI components render without expected styles.

Standardize Team Setup

Review design references and MCP configuration, then document project prerequisites and pending verification for a team handoff.

これらのプロンプトを試す

Inspect Prerequisites

Inspect my React project with WunderUI detection in dry mode. Identify the framework, Tailwind version, and CSS entry without installing packages.

Set Up With Approval

Set up WunderUI for my Free plan. Ask before installation or edits, and show downloaded agent instructions for review before inserting them.

Diagnose Styling Problems

Diagnose why my WunderUI buttons are unstyled. Check the Tailwind source path and stylesheet order, preserve my tokens, and verify the probe.

Review a Local Checkout

Review my built WunderUI checkout before setup. Check shell arguments, lifecycle scripts, and MCP version trust; require approval before execution and report remaining checks.

ベストプラクティス

Review dependency sources, lifecycle scripts, downloaded rules, and the MCP launcher before approving execution.
Run detection first, confirm Tailwind v4, and agree on token precedence before editing the CSS entry.
Keep a recoverable project snapshot, inspect changes, and verify both the probe rendering and MCP availability.

回避

Treating --dry checkout installation as a guarantee that no subprocesses run or files change.
Automatically trusting downloaded instruction files or an unpinned MCP package.
Removing project token overrides or declaring setup complete without consent and browser verification.