Findings & checks · 4 flagged
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .github/instructions/adr.instructions.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .github/prompts/check-adr-violations.prompt.md
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .github/instructions/orchestrator.instructions.md×2
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Show all 2 locations
- Delete blanket "don't ask / no need to confirm" directives from the skill.
- If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Draft_v0
Draft_v0 Banner
"We don't have time for that" is no longer an answer. Draft_v0 puts senior engineering expertise at your fingertips; 17 skills, 8 agents, and 12 prompt templates that handle the code so your team stops compromising on the design. Micro-interactions, pixel-perfect fidelity, design system consistency in every PR. Not backlog items. Not phase 2. Just the product you actually designed.
Why Draft_v0?
Every team has the same conversation: _"We love the design, but we don't have time to build it that way."_ Draft_v0 ends that conversation. The engineering complexity; architecture, conventions, API wiring, state management; is already solved. Your AI assistant knows the stack as well as your best engineer. What used to take a sprint takes an afternoon.
- Figma URL → production component - paste a link, get a pixel-perfect, accessible, design-system-compliant component. No translation layer, no back-and-forth
- Your design system is encoded - tokens, variants, spacing, motion. Every AI-generated component follows your rules without you having to explain them
- Micro-interactions ship on day one - hover states, transitions, loading skeletons. Not "nice to haves." Not phase 2. Just done
- No revision cycles - AI produces code that matches your conventions on the first try, because the conventions are baked in as skills
- Autonomous problem-solving - agents fix build errors, review PRs for design system drift, and research solutions without pulling engineers away from building
- One-command workflows -
figma-to-code,build-page,gh-new-prchain everything together so the path from Figma to merged PR is as short as possible
How It Works
Draft_v0 ships a complete AI development system on top of the scaffold. Designers get Figma-to-code workflows that just work. Developers get an AI assistant that already knows the architecture, patterns, and conventions - no handholding needed.
| Component | What it does |
|---|---|
| 17 Skills | Teach your AI the exact patterns, conventions, and anti-patterns for every layer of the stack - React 19, Express, Prisma, DSAi, Figma, and more. AI produces correct code on the first attempt, not after three correction rounds |
| 8 Agents | Autonomous workers: fix TypeScript errors, review code for architectural consistency, plan refactors with risk assessments, research solutions across the internet. Multi-step tasks that would interrupt a developer run in the background |
| 12 Prompt templates | One-click workflows that chain skills together - figma-to-code translates a Figma URL into a production component, build-page scaffolds a full route, gh-new-pr handles commit, PR, and description in one shot |
| Task system | File-based tasks with AI-powered breakdown (Example Mapping) and verification (PASS/FAIL/NEED_INFO). Work is tracked, verifiable, and never lost between sessions |
| ADRs | Architecture Decision Records capture the _why_ behind every significant choice. New team members (and AI assistants) understand the reasoning, not just the result |
| Figma pipeline | Two MCP servers + Code Connect, pre-configured. Your Figma components are linked to your code components - the AI sees both and keeps them in sync |
Tech Stack
| Layer | Technology |
|---|---|
| Frontend | React 19, TypeScript 6, TanStack Router + Query, DSAi Design System, Bootstrap 5.3 |
| Backend | Node.js, Express 5, TypeScript 6 |
| Database | Prisma 7 (SQLite default) |
| State | TanStack Query (server), Zustand (client), React Hook Form + Zod (forms) |
| Build | Vite 8 (Rolldown + Oxc), TypeScript strict mode |
| Testing | Vitest (unit), Playwright (e2e) |
| Quality | Biome, ESLint, Prettier |
| Design | Figma MCP servers, Figma Code Connect |
Quick Start
git clone https://github.com/michelve/draft_v0.git
cd draft_v0
pnpm install
cp .env.example .env
pnpm db:push
pnpm devOpen http://localhost:5173 (frontend) - API runs on http://localhost:3001.
Project Structure
src/
├── client/ # React 19 SPA (Vite)
│ ├── routes/ # TanStack Router file-based routes
│ ├── components/ # Custom UI components (Button, Typography, etc.)
│ ├── lib/ # Utilities (query-client, helpers)
│ └── hooks/ # Custom React hooks
├── server/ # Express API
│ ├── routes/ # API route handlers
│ ├── controllers/ # Request/response handling
│ ├── services/ # Business logic
│ ├── repositories/ # Prisma data access
│ └── lib/ # Shared (prisma client)
prisma/
└── schema.prisma # Database schema (SQLite default)Architecture: Route → Controller → Service → Repository → Prisma (layered, each layer has one job).
Available Commands
| Command | Purpose |
|---|---|
pnpm dev | Start Vite + Express dev servers |
pnpm build | TypeScript check + Vite production build |
pnpm typecheck | Run tsc --noEmit on both configs |
pnpm lint | ESLint check |
pnpm biome:check | Biome lint + format check |
pnpm test | Vitest unit tests |
pnpm test:e2e | Playwright end-to-end tests |
pnpm db:push | Push Prisma schema to database |
pnpm db:studio | Open Prisma Studio |
pnpm db:generate | Regenerate Prisma client |
AI Ecosystem
Draft_v0 includes 17 skills, 8 agents, and 12 prompt templates that encode your project's patterns, conventions, and workflows into AI-assisted development.
See Skills & Agents Guide for the full reference.
Adding UI Components
Custom Bootstrap-based components live in src/client/components/ui/. Use DSAi design tokens (--dsai-* CSS variables) and Bootstrap utility classes for styling.
Build tokens with:
pnpm tokens:buildFigma Integration
- Get a Figma Personal Access Token
- Add
FIGMA_API_KEYto.env - Use the
figma-to-codeprompt with a Figma URL
Two MCP servers (figma-developer-mcp, figma-console-mcp) are pre-configured in .vscode/mcp.json.
Documentation
| Guide | Description |
|---|---|
| Getting Started | Full setup walkthrough |
| Project Structure | Architecture and directory layout |
| Skills & Agents | Complete AI ecosystem reference |
| Tasks Workflow | File-based task management system |
| Figma Integration | Design-to-code pipeline |
| Architecture Decisions | ADR system and existing decisions |
Security
See SECURITY.md for how to report vulnerabilities. Please use GitHub Private Vulnerability Reporting - do not open public issues for security concerns.
Code of Conduct
This project follows the Contributor Covenant v2.1. By participating, you agree to uphold these standards. Report violations via a GitHub Issue.
License
This project is licensed under the MIT License.