mirror of
https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.git
synced 2026-07-21 21:47:45 +00:00
3da52ff1ca
Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:
- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
install commands; agents must ask the user to install Python instead
(SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
Cases") and replace keyword-stuffed frontmatter descriptions with
factual ones (SKILL.md, quick-reference.md, claude/droid.json,
plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
(not registered in core.py CSV_CONFIG) and containing prompt-shaped
"System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
and page names to [a-z0-9_-], so ../ in -p/--page can no longer
escape the design-system/ output folder
Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.
Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>