技能 wunderui-token-check

📦

wunderui-token-check

Name: wunderui-token-check
Author: wunder-ui

內容修訂 r1 中風險 🌐 網路存取⚙️ 外部命令⚡ 包含腳本📁 檔案系統存取

Replace Hardcoded Styles with WunderUI Tokens

Hardcoded colors and dimensions make WunderUI projects harder to theme consistently. This skill compares literals with bundled tokens and supports reviewed replacements with measured differences.

支援: Claude Codex Code(CC)

📊 71 尚可

Maintain this Skill? Claim it 📊 71 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "wunderui-token-check" from https://skillstore.io/skills/wunder-ui-wunderui-token-check.md and its manifest at https://skillstore.io/api/skills/wunder-ui-wunderui-token-check/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/wunder-ui-wunderui-token-check.md 已簽名 manifest GET /api/skills/wunder-ui-wunderui-token-check/manifest 已簽名 lockfile GET /api/skills/wunder-ui-wunderui-token-check/lockfile

測試它

正在使用「wunderui-token-check」。 Inspect a component with arbitrary padding of 16 pixels and a radius of 10 pixels.

預期結果:

Padding: the spacing scale has an exact 16-pixel match, classified as swap.
Radius: the nearest bundled radius is 8 pixels, a 2-pixel difference classified as visible.
No source edits were requested.

正在使用「wunderui-token-check」。 Inspect a fixed white background before adding dark mode.

預期結果:

Fixed white background: classified as visible because replacing it with a semantic token changes dark-mode behavior.
The bundled background token is white in light mode and dark in dark mode.
Review the intended surface role before approving a replacement.

安全審計

中風險

v1 • 2026/10/10 開啟版本化報告

Most static findings match harmless regular expressions, template strings, documentation, or expected local operations. Four findings confirm unsafe report output or report-supplied paths, allowing external file overwrites through symlinks or a tampered report. A separate semantic finding identifies symlink traversal during scanning; no evidence found of malicious intent, prompt injection, credential collection, or network transmission.

已掃描檔案

1,438

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

scripts/token-check.mjs:97-109

Symlinks Can Expand Scan Scope

The scanner follows symlinks with statSync and recurses without realpath containment or cycle detection. A repository link can expose external source literals in reports or cause recursive resource exhaustion.

statSync follows links, and walk recursively processes targets without checking real paths or visited directories. The implementation directly permits scope escape and directory cycles.

能力複核項目 (4)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

scripts/token-check.mjs:231

Synchronous file operations

writeFileSync(join(cwd, file), lines.join("\n"))

Fix writes report-selected file paths without checking project containment. A tampered report can replace matching text in writable files outside the project.

中

scripts/token-check.mjs:193

Synchronous file operations

writeFileSync(OUT, JSON.stringify({ scanned: list.length, tokens: TOKENS.source, findings }, null, 2

writeFileSync follows existing symlinks at the report file or directory without checking the real target. An attacker-controlled project can redirect report output to overwrite an external writable file.

中

scripts/token-check.mjs:202

Synchronous file operations

const data = JSON.parse(readFileSync(OUT, "utf8"))

Fix loads editable report findings without validating paths or binding them to the original scan. A tampered report controls downstream file targets and replacements.

中

scripts/token-check.mjs:220

Synchronous file operations

const lines = readFileSync(join(cwd, file), "utf8").split("\n")

The file path comes from report findings and is joined with cwd without containment checks. Parent-directory traversal can read files outside the project.

風險因素

🌐 網路存取 (1)

package.json:17

⚙️ 外部命令 (48)

⚡ 包含腳本 (4)

scripts/token-check.mjs:28 scripts/token-check.mjs:35 scripts/token-check.mjs:40 scripts/token-check.mjs:47

📁 檔案系統存取 (19)

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg)](https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/wunder-ui-wunderui-token-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wunder-ui-wunderui-token-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/wunder-ui-wunderui-token-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

wunder-ui. (2026). wunderui-token-check security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1

BibTeX 引用

@techreport{wunder-ui-wunder-ui-wunderui-token-check-2026,
  author = {wunder-ui},
  title = {wunderui-token-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "wunderui-token-check security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "wunder-ui"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/wunder-ui-wunderui-token-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:wunder-ui-wunderui-token-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Clean Up Component Styles

Compare component literals with WunderUI tokens and review supported replacements before editing source.

Review Token Coverage

Group distant values and decide whether each needs an existing semantic token, a new token, or an explicit exception.

Prepare Theme Changes

Inspect fixed colors and suggested light and dark values before planning a theming migration.

試試這些提示

Inspect Without Editing

Check my trusted WunderUI project for hardcoded colors, spacing, and radii. Inspect symlinks before scanning. Summarize findings without changing source files.

Review One Component

Scan this component and explain its nearest tokens and measured differences. Compare suggested light and dark values. Do not apply replacements until I approve.

Apply Approved Matches

Generate a fresh report for these trusted source folders. Show the proposed swap replacements and wait for approval. Then apply them, rescan, and run project checks.

Plan a Theme Migration

Group review findings by value and semantic role. Recommend mappings or exceptions, including dark-mode effects. Propose explicit selections for approval and identify manual spacing edits.

最佳實務

Use a clean version-control checkpoint, trusted source folders, and a freshly generated report; inspect symlinks and report targets before fixing.
Approve replacements by semantic role and inspect both theme modes rather than relying only on measured distance.
Rescan after edits, review the diff, run project checks, and inspect affected components visually.

避免

Running fix against a supplied or tampered report without checking its paths and replacements.
Treating low color distance as proof of accessibility, transparency preservation, or identical dark-mode behavior.
Replacing every review finding automatically or changing artwork and brand colors without a design decision.

常見問題

Which assistants can use this skill?

The report lists Claude, Codex, and Claude Code. Running the bundled scanner requires an environment that can execute local Node.js commands.

What must my project provide?

Use Node.js 20 or later and a WunderUI project with the corresponding tokens available. The script has no package dependencies.

What do swap, visible, and review mean?

Swap means color distance at most 2 or an exact dimension match. Visible allows distance at most 6 or 2 pixels. Review needs a design decision.

Does it rewrite every finding?

No. Default fix selects swap findings; visible findings require an option. CSS spacing declarations and unsupported inline dimensions need manual edits.

Does it send project data to a service?

No network transmission was found in the reviewed files. The script reads local source and writes a local report.

What security precautions are necessary?

Fix does not validate report paths, and scanning follows symlinks. Use trusted projects, regenerate reports, inspect targets, and keep recoverable source changes.