mirror of https://github.com/nextlevelbuilder/ui-ux-pro-max-skill.git synced 2026-07-21 21:47:45 +00:00

History

security: harden skill against agent-audit risk patterns (#417 )

Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:

- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
  install commands; agents must ask the user to install Python instead
  (SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
  Cases") and replace keyword-stuffed frontmatter descriptions with
  factual ones (SKILL.md, quick-reference.md, claude/droid.json,
  plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
  (not registered in core.py CSV_CONFIG) and containing prompt-shaped
  "System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
  and page names to [a-z0-9_-], so ../ in -p/--page can no longer
  escape the design-system/ output folder

Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.

Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

2026-07-10 21:30:06 +07:00

assets

security: harden skill against agent-audit risk patterns (#417 )

2026-07-10 21:30:06 +07:00

scripts

fix: validate design data and support node builds

2026-07-03 23:16:28 +00:00

src

fix: validate design data and support node builds

2026-07-03 23:16:28 +00:00

.gitignore

feat: add uxpro-cli for easy skill installation (#4 )

2025-12-02 18:55:29 +07:00

.npmignore

fix: exclude settings.local.json from cli install (#16 )

2025-12-03 12:14:31 +07:00

bun.lock

feat: add uxpro-cli for easy skill installation (#4 )

2025-12-02 18:55:29 +07:00

package-lock.json

fix(cli): publish under fallback npm package (#393 )

2026-06-26 11:02:09 +07:00

package.json

fix: validate design data and support node builds

2026-07-03 23:16:28 +00:00

README.md

fix(cli): publish under fallback npm package (#393 )

2026-06-26 11:02:09 +07:00

tsconfig.json

feat: add uxpro-cli for easy skill installation (#4 )

2025-12-02 18:55:29 +07:00

README.md

ui-ux-pro-max-cli

CLI to install UI/UX Pro Max skill for AI coding assistants.

Installation

npm install -g ui-ux-pro-max-cli

Usage

# Install for specific AI assistant
uipro init --ai claude      # Claude Code
uipro init --ai cursor      # Cursor
uipro init --ai windsurf    # Windsurf
uipro init --ai antigravity # Antigravity
uipro init --ai copilot     # GitHub Copilot
uipro init --ai kiro        # Kiro
uipro init --ai codex       # Codex (Skills)
uipro init --ai roocode     # Roo Code
uipro init --ai qoder       # Qoder
uipro init --ai gemini      # Gemini CLI
uipro init --ai trae        # Trae
uipro init --ai opencode    # OpenCode
uipro init --ai continue    # Continue (Skills)
uipro init --ai all         # All assistants

# Options
uipro init --offline        # Compatibility flag; installs bundled templates
uipro init --force          # Overwrite existing files

# Other commands
uipro versions              # List available versions
uipro update                # Update the global CLI to the latest release

GitHub Authentication

GitHub's unauthenticated API allows 60 requests/hour per IP. If you hit rate limits, you can provide a GitHub Personal Access Token (PAT) to raise the limit to 5,000 requests/hour.

Options (in order of precedence):

# 1. Pass directly as a flag (one-off use)
uipro init --token ghp_yourtoken
uipro versions --token ghp_yourtoken
uipro update --token ghp_yourtoken

# 2. Set as a project-scoped environment variable (recommended)
export UI_PRO_MAX_GITHUB_TOKEN=ghp_yourtoken
uipro init

# 3. Fallback: GITHUB_TOKEN is also read if UI_PRO_MAX_GITHUB_TOKEN is not set
export GITHUB_TOKEN=ghp_yourtoken
uipro init

Creating a token: Go to https://github.com/settings/tokens, click Generate new token (classic), and select no scopes — public repo access requires no permissions. Copy the token and store it as an environment secret; never hardcode it in source files.

Warning: GITHUB_TOKEN is automatically injected by GitHub Actions with broad repo permissions. Prefer UI_PRO_MAX_GITHUB_TOKEN in CI to avoid accidentally attaching workflow credentials to release download requests.

How It Works

uipro init generates assistant-specific files from the templates bundled with the installed CLI package. To get newer templates and data, update the package, then regenerate:

uipro update                   # updates the global CLI to the latest release
uipro init --ai codex --force  # regenerate skill files from the new package

uipro update runs npm install -g ui-ux-pro-max-cli@latest for you (it shells out to npm only on Windows, where npm is a .cmd). You can still run that command manually if you prefer. When the CLI is already current, uipro update just refreshes the installed skill files.

Development

# Install dependencies
bun install

# Run locally
bun run src/index.ts --help

# Build
bun run build

# Sync bundled CLI assets from the source skill
npm run sync:assets

# Verify bundled assets are current before publishing
npm run check:assets

# Link for local testing
bun link

License

CC-BY-NC-4.0