ui-web — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ui-web (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are generating production-grade web UI in React + TypeScript + Tailwind. This skill exists because untouched LLMs produce AI slop: purple→blue gradients, Inter everywhere, 3-icon-card grids, "Lightning fast / Powered by AI" copy, glassmorphism by default, arbitrary spacing values, and the median of every Tailwind tutorial scraped from GitHub. This skill replaces guesses with constraints.
The non-negotiable rule: NEVER use a buzzword in place of a token. Words like clean, modern, professional, sleek, premium are banned from your reasoning. Every aesthetic choice must trace back to a named anchor recipe in anchors.md and a token in the project's tailwind.config.ts.
Before any other action, check for:
DESIGN_RULES.md # at repo root → if exists, you are in EXTEND mode
tailwind.config.{ts,js} # → if exists with custom theme, you are in EXTEND mode
app/globals.css # check for CSS custom properties / tokens
src/styles/tokens.csstailwind.config.*. Skip to Step 3 (Phase 2: UI). Use only existing tokens. NEVER add new colors/spacing/radii without asking.DESIGN_RULES.md and proceed to Phase 2.Use AskUserQuestion to gather, in this order:
anchors.md (one-line summary each). Let the user pick 1–3. If 2–3, ask which is primary and which contributes type vs color vs motion.ban-patterns.md with the 3 default-on items pre-checked. Confirm.Do NOT ask vibe questions ("how should it feel?"). Ask only the questions above.
Generate, in this order:
theme using the chosen anchor's recipe. Use the template at templates/tailwind.config.ts.tmpl. Required keys: colors, spacing, borderRadius, fontSize, fontFamily, boxShadow, transitionDuration, transitionTimingFunction.src/index.css for Vite) — CSS custom properties mirroring the Tailwind tokens, plus dark-mode overrides if requested.templates/eslint.slop.cjs.tmpl. Add a lint:design script to package.json.templates/DESIGN_RULES.md.tmpl with the chosen anchors, active bans, token file paths, and verification command.Before any UI/UX work, read and follow DESIGN_RULES.md.Then run the Token Audit from verification.md and print the PASS/FAIL table to the user. Do not proceed to Phase 2 until the user approves.
Generate the requested screen/component using only tokens from the config. Follow:
Then run the UI Audit from verification.md AND pnpm lint:design (or npm/yarn equivalent). Print the audit table. Fix every FAIL before claiming done.
| File | When to read |
|---|---|
anchors.md | Step 1, before showing the user choices. ALWAYS read fully — never quote from memory. |
ban-patterns.md | Step 1, when showing ban menu. Step 2 and 3, when verifying. |
component-anatomy.md | Step 3, before writing any component. |
motion.md | Step 3, when adding any transition or animation. |
copy-voice.md | Step 3, before writing any user-facing string. |
icons-imagery.md | Step 3, when choosing icons or images. |
verification.md | After Step 2 (Token Audit) and after Step 3 (UI Audit). MANDATORY — do not skip. |
templates/* | Use as the basis for the generated files; fill placeholders, never ship as-is. |
mt-[13px], w-[372px], text-[#3a4f6b], rounded-[7px]. Every value must be a token in tailwind.config.ts. If you need a value that does not exist, ask the user to add it to the token set.bg-gradient-to-r from-purple-* to-pink-*, no from-indigo-* to-purple-*, no backdrop-blur on regular cards (only on iOS-style chrome/sheets if anchor allows).focus:outline-none without an explicit replacement.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.