unshift-website-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited unshift-website-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Unshift turns this conversation into a real, published website. You drive it through the Unshift MCP connector: you describe and author the site with the connector's tools, and Unshift stores, renders, and publishes it to a live URL the user owns. The user's own account runs the build; everyday edits later happen in Unshift's visual editor.
Use this skill whenever the user wants to build a new site, rebuild or import an existing site from a URL, or edit and publish an Unshift site.
LinkType object ({ id: "", href: "/path", target: "_self" }), never a bare string or a url field. Images are ImageType, icons are IconType, forms are FormType. Untyped values silently fail to resolve.siteUrl and an editorUrl. The site is not done until you call it.create_app to create the app (returns appId, appUrl). This is the first step; commit to the whole sequence.generate_theme immediately after, with a complete palette: light and dark values for all 19 color tokens, plus radius, heading font, and body font. Pass aiContext (the design brief) so later sessions can reuse it.set_layout to place the shared header and footer. Author them as blocks with a semantic <header> / <footer> root element (not a <Section> wrapper). The layout shows on every page, so never put the header or footer in page content.add_page for each page. Use slug "" for the home page. Author each block as { componentName, content } per block_guide, or reuse one of this app's existing blocks with { blockId, props } to repeat a section across pages instead of duplicating it. Pass seo and any assetMap.finalize_app to publish. Share both the siteUrl (live in about 1 to 2 minutes) and the editorUrl.Use import_assets with the image URLs to download them; it returns a sourceUrl-to-imageId map. Pass that map back as assetMap on the SAME set_layout / add_page / add_block / edit_block call that authors the matching { id: "PENDING_ASSET:<sourceUrl>" } props. The swap only happens on that authoring call. Use import_icon for a logo.
plan_import with the URL first. It is a read-only crawl that returns the theme, the sections, a suggested block mapping, the pages, and follow-up questions. It creates nothing.scrape_site, segment_page, suggest_blocks, and extract_theme expose the individual steps.get_app for the theme and page list; get_page to read one page's blocks, props, and SEO before editing. Read first when you did not author the page this session, so you target the real prop names rather than guessing.edit_block to change a block (deep-merge with propUpdates, full replace with props, or rewrite component code). A code rewrite affects every page that reuses that block; check get_block usedOn and tell the user when an edit spans pages.add_block, move_block, remove_block, update_page, and update_app cover the rest. undo_last_change reverts your most recent change-set.finalize_app saves a DRAFT (it returns published: false); tell the user it is a draft to publish from the editor. Only publish a live site when the user explicitly asks ("publish now"), via finalize_app with autoPublish: true. Use submit_for_review to hand a draft to the user to approve or decline.inspect_data_source to read the response shape, create_data_connector to connect it, create_post_type for a templated collection, and set_block_data_mapping to bind block props to endpoint fields.setup_wordpress (one call: connector, post types, and template pages), then configure_flexible_content for ACF flexible-content layouts.setup_commerce (provider unshift for a native store, or shopify with a Storefront token), then add_product for the native catalog.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.