plan-uiux-unification — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-uiux-unification (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Role: Senior frontend/mobile architect + design-systems engineer.
Task: Deep, exhaustive, non-destructive audit. Built by many devs over time → expect inconsistent design system, layout, typography, and repo rules. Find every violation, document it, produce a burndown + enhancement plan. Enhance the existing design system; do not replace it, strip features, fabricate data, or rewrite UI in this pass.
| Skill | Does |
|---|---|
| plan-uiux-unification (this) | Plan only — full inventory, burndown, roadmap; no fixes |
audit-uiux-design-system | Visual/token/component audit; may recommend or fix |
audit-ux | Heuristics, flows, microcopy quality |
enhance-web-ui / enhance-web-ux | Implement visual/UX improvements |
design-system | Build or extend the design system itself |
Chain: Step 1 of six-skill plan loop — see docs/PLAN-LOOPS.md Execute: enhance-web-ux / enhance-web-ui → test-playwright
Read references/preservation-contract.md in full before Phase 0.
Acknowledge in output #1 — restate what you will NOT do:
0. Context & IA (before any layout talk)
1. Design-system ground truth
2. Full surface inventory
3. Per-surface deep audit
4. Burndown (prioritized + risk)
5. Unification & enhancement plan
6. Best-practice research (cite current year)Detailed instructions: references/phase-workbook.md Templates: references/output-templates.md
Before pixels: user goal, primary task, key action, IA map (primary/secondary/tertiary), content relationships, progressive disclosure.
Core anti-pattern to flag: flat vertical stacks + left-align + no hierarchy/grouping.
Only then propose layout using real content from the codebase — never invented examples.
Auto-detect (read actual files):
Glob: **/tailwind.config.*
Glob: **/globals.css **/tokens.* **/theme.*
Glob: **/components/ui/**
Grep: "STYLEGUIDE|CONTRIBUTING" glob "**/*.md"Critique: enhance (missing semantic tokens, thin scales) vs enforce (violations of existing rules). Multiple systems → name canonical vs legacy + collision points.
Output short design-system spec (current state + proposed enhancements).
Exhaustive checklist table — every route, modal, drawer, toast, empty/loading/error state, auth/onboarding, responsive + dark per surface. Mark audited only after Phase 3 review.
See inventory template in references/output-templates.md.
For each surface, log violations by category:
Three buckets: violates documented rule · subjective improvement · needs DS enhancement
Token sweep (quantify for burndown):
Grep: "#[0-9a-fA-F]{3,8}" glob "*.{tsx,jsx,vue,css}"
Grep: "style=\\{" glob "*.{tsx,jsx}" output_mode "count"
Grep: "className=.*\\b(p|m|gap|text|rounded)-\\[" glob "*.{tsx,jsx}" output_mode "count"Optional visual verification: read protocol-browser-anti-stall and references/playwright-session-coordination.md in that skill before browser MCP. Plan-only — screenshots for evidence, not fixes.
Table columns:
Surface | Violation | Category | Severity (P0–P3) | Effort (S/M/L) | Risk (Low/Med/High) | Canonical fix | File path(s)
P0 = broken/inaccessible/brand-breaking · P3 = cosmetic. Quantify where possible.
Firecrawl / web for current year best practices; cite sources:
Note where this app diverges from research.
[NEEDS REAL CONTENT] listDeliver as a single markdown doc (or canvas for large repos). Do not open PRs or edit UI code unless the user explicitly approves execution in a follow-up.
| MCP | Use |
|---|---|
| Firecrawl | Phase 6 research, anti-AI-slop patterns, WCAG/token governance |
| Playwright browser | Optional Phase 3 visual evidence; shared session per protocol-browser-anti-stall |
| Context7 | Component library / Tailwind docs when naming canonical primitives |
| Sequential Thinking | Complex IA maps or multi-system collision analysis |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.