ui-creator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ui-creator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
At least one of UI images or OpenAPI spec must be provided
Detect from the project or ask the user:
Follow the platform file for scaffolding and project inspection commands
Ensure playwright and tsx are available:
test -d node_modules/playwright && test -d node_modules/tsx || npm install playwright tsx
npx playwright install chromium.md file (e.g. instrucciones.md) in the source directory. If found, read it and use it for:.mdGET returning an array → list page (table or card grid)GET with path parameter returning an object → detail pagePOST/PUT accepting a request body → form page (create or edit)DELETE, PATCH → not standalone pages, they are actions within other pagesSkip endpoints that are clearly sub-resources or actions of an already-mapped page. Name inferred routes from the endpoint path (e.g. /rest/orders → route /orders, component orders)
List what was found. Image-based pages are always generated. If there are inferred pages from OpenAPI, present them to the user and ask which ones to include using AskUserQuestion (multiSelect: true). If no inferred pages exist, proceed immediately
Pages from images (always generated):
- home/ → route: /home (image: home.png) — hero banner, product grid
- login/ → route: /login (image: login.png) — login form
Pages inferred from OpenAPI (no image):
- orders/ → route: /orders — list page (GET /rest/orders → array)
- order-detail/ → route: /orders/:id — detail page (GET /rest/orders/{id} → object)After the user confirms, proceed to Step 5 with only the selected inferred pages
Follow the platform file to generate:
:root tokens in the platform's global stylesheetRead OpenAPI spec if provided — identify endpoints, parameters, and response shapes
If business instructions were found, use them to determine route parameters, service call triggers, and cross-component interactions (e.g., refreshing a header counter after a cart update)
After writing mock-server.ts, verify every image URL in the mock data with a HEAD request:
curl -s -o /dev/null -w "%{http_code}" "<url>"Any URL that does NOT return 200 must be replaced with a placehold.co fallback:
https://placehold.co/<w>x<h>/E8F5E9/333?text=<name>Where <w>x<h> matches the original dimensions and <name> is the item name
Do NOT proceed to Step 6 until all image URLs return 200
If OpenAPI services were generated, start the mock server first (npx tsx mock-server.ts), then start the dev server in background on an available port. If port 4200 is in use, try 4201, 4202, etc. (e.g. ng serve --port 4201, npm run dev -- --port 5174). Use the actual assigned port in all URLs used during screenshot capture
Check if the project already has generated components with templates and styles. If so, review them and build an initial style reference from their existing patterns and tokens. Otherwise, initialize an empty style reference document. This is a living document that grows with each page
#### Phase A: Image-based pages (skip if no images)
For each page that has an image, in order from most visually complex to simplest:
The style reference accumulates across pages, so later pages benefit from all prior learnings. Process ALL image-based pages in a single uninterrupted loop
After all image-based pages are processed, list which pages were generated via the image-to-component procedure. If any image-based page is missing, invoke the skill for it before continuing
CRITICAL: Do NOT stop here. Do NOT return control to the user. Immediately proceed to Phase B below in the same response
#### Phase B: Inferred pages (from OpenAPI, no image)
For each inferred page, generate the template and styles directly — the image-to-component procedure requires an image. Use the design tokens and any accumulated style reference from Phase A (or the default tokens if no images were provided) to ensure visual consistency
For each inferred page:
Process ALL inferred pages in a single uninterrupted loop. Do NOT stop or return control to the user — immediately continue to Step 7
Follow the platform file for implementation patterns. All platforms must implement:
/rest/items) which the dev proxy routes to either the mock server or a real backendmock-server.ts) — see mock-server-template.md. Mock data uses real public image URLs (Unsplash preferred for thematic accuracy). For repeated grids/lists, limit mock data to 6–8 representative items. After generating the mock server, verify all image URLs with HEAD requests and replace any 404 with working alternatives. Use https://placehold.co/<w>x<h>/E8F5E9/333?text=<name> as last resortconcurrently to start both mock server and app dev server with a single command<img> elements in containers with background: var(--color-bg-secondary) so that when images fail to load, the background color shows through. Do NOT use JS onerror handlers or placeholder image filesGeneXus backend? → Read genexus-backend.md for additional requirements (gxid, GX_CLIENT_ID cookie, endpoint call order, proxy Accept header)
Run the platform's build command to verify no compilation errors:
ng buildnpm run buildComponent generation: For pages with images, NEVER write component templates/styles directly — ALWAYS follow the image-to-component.md procedure. For inferred pages (no image), generate templates and styles directly using the design tokens and any accumulated style reference. All pages must be screenshot-verified for visual consistency
Paths: Always use forward slashes (/) in bash commands
Dev server: The dev server must be running before running the image-to-component procedure
Check before creating: Verify component/view doesn't already exist. Update if it does
Asset references: Every static asset referenced in templates or code (icons, etc.) must exist as a real file. Create the file in the same step where you write the reference — never point to a path that doesn't exist yet. Do NOT create placeholder image files — use CSS background fallback instead (see Step 7, item 7)
File discipline:
Uninterrupted execution: Process all pages from start to finish without pausing for user confirmation. User interaction points are Step 1 (platform selection, if not auto-detected) and Step 4 (inferred page selection, if OpenAPI provided). After Step 4, run Steps 5–8 autonomously
proxy.conf.js (Angular) or vite.config.ts (React), or ask you to switch it for them~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.