start-6c0a25 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited start-6c0a25 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- AUTO-GENERATED. Do not edit here. Source: skills/ui-craft/ + commands/*.md. Regenerate with node scripts/sync-harnesses.mjs. -->
Context: this sub-skill is one lens of the broader ui-craft skill. If the ui-craft skill is also installed, read its SKILL.md first for Discovery + Anti-Slop + Craft Test, then apply the specific lens below.
Orient the user. Load the ui-craft skill, read the current project, and report what ui-craft can do right now for it. This is the front door — most people run it first.
This command detects state and routes. It MUST NOT build, edit, audit, or re-implement any phase logic. It contributes only:
When the user wants to act, hand off to the real command (/brief, /tokens, /sddesign, /craft, /finalize, the review agents, etc.). Do not inline their steps.
Scan the project. Do not write anything. Gather:
| Signal | How to detect | Used for |
|---|---|---|
| Framework / styling | package.json deps, config files, file extensions — Tailwind, CSS Modules, styled-components/Emotion, vanilla CSS, Vue/Svelte/Astro SFC | Confirm ui-craft adapts to this stack |
| Token spine | CSS vars (--color-*, --accent-*, --font-*), Tailwind theme.extend, a token file | Gate: is /tokens needed? |
| Brief | .ui-craft/brief.md exists? | Gate: is /brief needed? |
| Spec | .ui-craft/spec.md exists? which surfaces? | Is there work in flight? |
| Harness | Claude Code (plugin/skill) vs .codex/.cursor/.gemini/.opencode/.agents mirror | Which layers are reachable (agents/MCP are Claude Code / MCP-client only) |
| Existing UI | are there components/pages already, or is this greenfield? | Build-new vs review/polish framing |
Keep detection fast and quiet — a few reads, no deep traversal. Report findings as a short table.
Print what's available now, mapped to how people actually use ui-craft. Mark each layer ● active / ○ available / – not reachable in this harness.
ui-craft is a design engineering SYSTEM. You're set up for:
● Layer 1 — Just ask
Describe any UI and the agent designs with taste (anti-slop, system tokens,
real hierarchy). No command needed. This is the default and the point.
○ Layer 2 — Drive it
Slash commands for focused passes. Given THIS project:
<tailored list — see Step 3>
○ Layer 3 — Verify it
design-reviewer + a11y-auditor agents · ui-craft-mcp gates · UICraftScore · ui-craft-detect CLI.
<mark – if the harness can't reach agents/MCP, and say so>Tailor the bullets to the detected state — don't print the generic catalog.
Pick the single highest-value next action from detected state. Use this decision order:
/brief ("anchor every later decision to your product's principles — 5 min, writes .ui-craft/brief.md")./tokens ("establish the 3-layer token spine so builds match a system, not inline guesses")./sddesign <surface> (full pipeline) or /craft <surface> (one-shot) — ask which.ui-craft:design-reviewer + ui-craft:a11y-auditor (Claude Code) or /critique + /audit; polish → /polish; simplify → /distill./finalize (10-pass gate) and, for CI, npx ui-craft-detect or the score_ui MCP tool.Print it as one clear line:
Recommended next: … — <one-sentence why>.Then offer the full menu only if asked: "Want the full command list, or shall I run that now?"
If the user confirms, run the recommended command. Otherwise stop — /start never acts on its own. Its job is done once the user knows where they are and where to go.
/start writes nothing and changes no code. The artifacts (brief.md, spec.md, tokens) are written by their own commands..codex, .cursor, etc.), Layer 3 agents and the MCP server may not be reachable from that agent — say so plainly and point to the CLI (ui-craft-detect) as the portable verify path.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.