web-ui-radix-ui-1dd1ff — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited web-ui-radix-ui-1dd1ff (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Radix ships unstyled primitives that carry the behaviour and accessibility of a component and none of its appearance. Every primitive is a compound component —Root,Trigger,Portal,Content— sharing context;asChildmerges a primitive's behaviour onto your own element;data-stateattributes drive CSS animation. Current release is v1.8.x: React 19 and RSC compatible,forwardRefno longer required, andradix-uiis the unified package that replaces the individual@radix-ui/react-*ones.
Detailed Resources:
asChild, Slot.Root, Slot.Slottable and Slot.createSlotnonce, indeterminate Progressdata-state keyframes and height animationunstable_ primitives: OTP field, password toggle, Formexamples/core.md, then the file for the primitive family you need.
unstable_OneTimePasswordField, unstable_PasswordToggleField,unstable_Form. The prefix is the API contract: these change between minors, so follow examples/preview.md and expect to revisit on upgrade.
@keyframes keyed todata-state covers fades, slides and height; orchestrated sequences need forceMount. Both are in examples/animation.md.
<critical_requirements>
Install the unified `radix-ui` package rather than individual @radix-ui/react-* ones. One version of the shared internals means no duplicate context providers and no stacking-order conflicts between primitives.
Give overlays their full anatomy — `Root`, `Trigger`, `Portal`, `Overlay`, `Content`, `Close`. Each part registers itself with the Root's context; a missing part removes the behaviour it carried rather than just its markup.
Wrap overlay content in `Portal`. Content rendered in place inherits every ancestor's overflow: hidden and stacking context, so a dialog inside a scrolling panel is clipped by it.
Give every Dialog and AlertDialog a `Title`. It is what a screen reader announces on open, and since v1.6.0 Radix no longer logs an error when it is missing.
Forward the ref and spread every prop on a component used with `asChild`. The ref is how Radix positions floating content and returns focus on close; the spread is how the ARIA attributes and event handlers reach the DOM element. React 19 passes ref as an ordinary prop; below that it needs a forwardRef wrapper.
</critical_requirements>
Auto-detection: radix-ui, @radix-ui, Dialog.Root, AlertDialog, DropdownMenu, Popover, Tooltip, Accordion, Tabs, Select.Viewport, asChild, Slot, Slottable, ItemIndicator, data-state, forceMount, onOpenAutoFocus, onInteractOutside, --radix-accordion-content-height, unstable_OneTimePasswordField, unstable_PasswordToggleField, unstable_Form
Applies to:
asChildasChild support, using SlotHandled elsewhere:
className; what produces that class is notthis skill's concern
Select or Checkbox reports its value andnothing more
aria-hidden; supplying real icons is aseparate choice
forceMount and data-state as the hooks apresence-detecting animation runtime attaches to
<philosophy>
Radix separates the two halves of a component that are usually welded together. It owns the half that is hard and invisible — ARIA roles, focus order, dismissal semantics, collision detection — and leaves the half that is your product's identity entirely alone.
That split has a consequence worth internalising: a primitive is a set of parts, not a component with props. Dialog is not a thing you configure; it is Root, Trigger, Portal, Overlay, Content, Title, Description and Close, communicating through context you never see. You compose the parts you need, in the arrangement your design calls for, and the coordination comes free. Reaching for a prop where a part exists is the usual sign of fighting the model.
</philosophy>
<decision_framework>
Blocking the page?
├─ Destructive confirmation → AlertDialog (no click-outside dismiss, by design)
├─ Form or content → Dialog
└─ Page-level, not blocking → Dialog with modal={false}, or Popover
Floating beside a trigger?
├─ Opened by click, holds interactive content → Popover
├─ Opened by hover or focus, text only → Tooltip
└─ A list of actions → DropdownMenu
Choosing from options?
├─ One value, in a form → Select
├─ Several values → Popover containing Checkbox items
└─ An action, not a value → DropdownMenu
Showing and hiding regions?
├─ One at a time, in place → Accordion (type="single" collapsible)
├─ Several at once → Accordion (type="multiple")
└─ One panel replacing another → Tabs</decision_framework>
<patterns>
Every overlay is the same six parts. Root holds the state, Portal escapes the layout, Title and Description carry the accessible name.
<Dialog.Root>
<Dialog.Trigger>Open</Dialog.Trigger>
<Dialog.Portal>
<Dialog.Overlay className={overlayClass} />
<Dialog.Content className={contentClass}>
<Dialog.Title>Account settings</Dialog.Title>
<Dialog.Description>Manage preferences and security.</Dialog.Description>
<Dialog.Close aria-label="Close">×</Dialog.Close>
</Dialog.Content>
</Dialog.Portal>
</Dialog.Root>Full code: examples/core.md
defaultOpen lets Radix own the state. open with onOpenChange takes it back — needed to close after an async save, to open from somewhere other than the trigger, or to mirror the URL. onOpenChange is the only channel for user intent, so a controlled primitive that omits it can never be dismissed.
const [open, setOpen] = useState(false);
<Dialog.Root open={open} onOpenChange={setOpen}>
{/* … */}
</Dialog.Root>;Full code: examples/overlays.md
asChild for polymorphismasChild tells a part to render its child instead of its own element, merging props and behaviour onto it. This is how a Tooltip.Trigger becomes an anchor, or a Dialog.Trigger becomes your own button, without a wrapper element.
<Tooltip.Trigger asChild>
<a href="/docs">Documentation</a>
</Tooltip.Trigger>A custom component in that position takes ref and spreads the rest, or the merge silently drops the handlers and ARIA attributes Radix passed down.
Full code: examples/core.md
asChild components with SlotSlot is the merging machinery asChild uses, exposed for your own components. Swap the rendered element for Slot.Root when asChild is set. Slot.Slottable marks where the child's content belongs when the component also renders fixed decoration around it.
function Button({ asChild = false, ...props }: ButtonProps) {
const Comp = asChild ? Slot.Root : "button";
return <Comp {...props} />;
}Slot.Slottable with child={children} and a render function as its children wraps the child's content in your own markup, while the child itself keeps the merged props. Slot.createSlot("Button") returns a Slot whose error messages name Button, and takes type arguments for the rendered element and its props.
Full code: examples/core.md
Portal moves content to document.body, out of every ancestor's clipping and stacking context. Pass container to send it somewhere else — a shadow root, an iframe body, or a micro-frontend's own mount point.
<Popover.Portal container={containerRef.current}>
<Popover.Content>
<Popover.Arrow />
</Popover.Content>
</Popover.Portal>Full code: examples/core.md
data-stateRadix sets data-state="open" and "closed" on the animatable parts and suspends unmount until the exit animation reports it has finished. It listens for animationend, so @keyframes delays the unmount and transition does not.
.dialog-overlay[data-state="open"] {
animation: fadeIn 150ms ease-out;
}
.dialog-overlay[data-state="closed"] {
animation: fadeOut 150ms ease-in;
}For sequences a JavaScript runtime drives, forceMount on Portal, Overlay and Content hands unmounting back to you.
Full code: examples/animation.md
Modal content traps focus and returns it to the trigger on close, with no configuration. Override where the initial focus lands with onOpenAutoFocus — a destructive confirmation should open on Cancel rather than on Delete.
<AlertDialog.Content
onOpenAutoFocus={(event) => {
event.preventDefault();
cancelRef.current?.focus();
}}
>Full code: examples/overlays.md
Title is the accessible name and is required. Where the design has no visible heading, keep the element and hide it visually — removing it removes the announcement, not just the text.
<VisuallyHidden asChild>
<Dialog.Title>Filter results</Dialog.Title>
</VisuallyHidden>Leaving out Description needs no workaround: since v1.6.3 Radix sets aria-describedby only when one renders.
Full code: examples/core.md
</patterns>
<red_flags>
Breaks at runtime:
asChild child that does not take a ref — Radix cannot measure or focus it, so floatingcontent mispositions and focus never returns; take ref as a prop (React 19) or wrap in forwardRef
asChild child that does not spread its remaining props — the merged event handlers andARIA attributes are dropped, leaving a trigger that looks right and does nothing
Portal — clipped by any ancestor with overflow: hidden, and layeredagainst the wrong stacking context
Title — no accessible name, and since v1.6.0 no console error to flag ittransition used for an exit animation — unmount is not delayed, so the element disappears beforeanything animates; use @keyframes
forceMount — Radix unmounts it themoment state flips, cutting the exit animation off at frame one
Surprising behaviour:
data-state flips to "closed" before the exit animation starts, not after it ends--radix-accordion-content-height and its siblings are set only while an animation is running,and read as empty outside one
Cancel or Action is the only way out,which is the point of choosing it
Slot merges handlers rather than replacing them, and the child's own handler runs firstz-index on portalled content fights the ordering Radix maintains betweenlayered primitives; isolate the container instead
Progress with value={undefined} is indeterminate rather than zeroSelect and ScrollArea take a nonce prop, needed wherever a Content Security Policy blocksunnonced inline styles
</red_flags>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.