Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:
- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
install commands; agents must ask the user to install Python instead
(SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
Cases") and replace keyword-stuffed frontmatter descriptions with
factual ones (SKILL.md, quick-reference.md, claude/droid.json,
plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
(not registered in core.py CSV_CONFIG) and containing prompt-shaped
"System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
and page names to [a-z0-9_-], so ../ in -p/--page can no longer
escape the design-system/ output folder
Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.
Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
cli/assets had fallen out of sync with src/ui-ux-pro-max ahead of this
change (unrelated to the motion-domain feature) - colors.csv, products.csv,
google-fonts.csv, draft.csv, several platform templates, and sub-skill
scripts/tests had all drifted. Ran the project's own `sync-assets.mjs`
to bring cli/assets back in line with the source of truth per the
documented Sync Rules; `--check` now reports assets as in sync.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix CLI asset sync
* fix(cli): normalize line endings in asset sync/check
check:assets hashed raw bytes, so identical CSV/JSON/py content with
CRLF vs LF (git autocrlf on checkout) was reported as stale drift,
blocking the release guard on Windows/mixed checkouts.
- fileHash now normalizes CRLF->LF before hashing, so check:assets
compares content, not line endings.
- sync:assets writes LF-normalized copies instead of a raw byte copy,
so re-syncing is deterministic across platforms.
All synced assets are text (csv/json/md/py); no binaries affected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* ci: enforce CLI asset sync on PRs
Adds a Check asset sync workflow that runs `npm run check:assets` on any
PR touching src/ui-ux-pro-max/** or cli/assets/**, so the bundled CLI
assets can't silently drift from the source of truth.
The check uses only node builtins (no install step) and normalizes
line endings before hashing, so it hard-fails on real content drift
without the CRLF/LF soft-fail hack other approaches needed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
- Warn when --global and --legacy are used together (init.ts)
- Update metadata across all platform templates (161 palettes, 15 stacks)
- Bump skill.json version from 2.0.0 to 2.5.0
- Re-throw non-ENOENT errors in uninstall.ts removeSkillDir
- Hoist detectAIType call to avoid double invocation in uninstall
- Add clarifying comment for .shared in AI_FOLDERS mapping
Add required name and description frontmatter to windsurf, kiro,
cursor, copilot, and roocode platform templates. Update agent.json
frontmatter with current capability counts.
Closes#204, #188, #43
Add support for Factory's Droid AI assistant, allowing users to install
the skill via 'uipro init --ai droid' to .factory/skills/ directory.
Changes:
- Add droid.json platform config (src and cli/assets)
- Add 'droid' to AIType and AI_TYPES array
- Add .factory directory detection
- Add droid to AI_TO_PLATFORM mapping
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
- Remove .shared folder dependency - all platforms now self-contained
- Each platform installation includes its own data/ and scripts/
- Update platform configs: reference → full install type
- Simplify template.ts: remove ensureSharedExists logic
- Update Cursor to Skill Mode (auto-activate)
- Update README to reflect Cursor in Skill Mode
- Bump CLI version to 2.2.2
Fixes issue where users couldn't find search.py in shared folder.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove Manual Installation section from README
- Add 67 styles table with # | Style | Best For format
- Update Supported Stacks table with all 13 stacks
- Simplify Usage section: group by Skill mode vs Workflow mode
- Fix counts: 57 font pairings (was 56), 99 UX guidelines (was 98)
- Change Windsurf from Workflow to Skill mode
- Update CLAUDE.md: remove prompt domain, add missing stacks
- Bump CLI version to 2.2.1
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
BREAKING CHANGES:
- Moved canonical data/scripts to src/ui-ux-pro-max/
- Removed duplicate folders (.codex/, .gemini/, .trae/, .codebuddy/, .continue/, skills/, .qoder/)
- CLI now uses template system instead of copying pre-built folders
New features:
- Merged prompts.csv into styles.csv with 4 new columns:
- AI Prompt Keywords
- CSS/Technical Keywords
- Implementation Checklist
- Design System Variables
- All 67 styles now have complete prompt data
- Added Astro stack (53 guidelines)
- Added 10 new 2025 UI trend styles
CLI changes:
- New template rendering system (cli/src/utils/template.ts)
- Reduced cli/assets from ~34MB to ~564KB
- Assets now contain only: data/, scripts/, templates/
File structure:
- src/ui-ux-pro-max/ - Single source of truth
- .claude/skills/ - Symlinks to src/ for development
- .shared/ - Symlink to src/ui-ux-pro-max/
Bumped CLI version: 2.1.3 → 2.2.0
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
