Andras Polgar 3da52ff1ca
security: harden skill against agent-audit risk patterns (#417)
Addresses the behavioral patterns that plausibly triggered the Gen
(Agent Trust Hub) High Risk rating on skills.sh, without changing
runtime functionality:

- Prerequisites no longer instruct agents to run sudo/brew/apt/winget
  install commands; agents must ask the user to install Python instead
  (SKILL.md, skill-content.md template, README.md, README.zh.md)
- Soften coercive invocation language ("Must Use" -> "Primary Use
  Cases") and replace keyword-stuffed frontmatter descriptions with
  factual ones (SKILL.md, quick-reference.md, claude/droid.json,
  plugin.json)
- Remove design.csv, draft.csv and _sync_all.py: unused by the runtime
  (not registered in core.py CSV_CONFIG) and containing prompt-shaped
  "System Prompt: ... You are ..." blocks that read as injection risk
- Fix path traversal in --persist: new safe_slug() restricts project
  and page names to [a-z0-9_-], so ../ in -p/--page can no longer
  escape the design-system/ output folder

Verified: validate-csv.py (35 files), smoke-domains (12/12),
smoke-stacks (22/22), check:assets in sync, persist traversal attempt
stays confined.

Co-authored-by: Andras Polgar <5525341+ruredi@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-10 21:30:06 +07:00

12 lines
733 B
JSON
Executable File

{
"name": "ui-ux-pro-max",
"description": "UI/UX design intelligence. Searchable local database with 84 styles, 161 palettes, 73 font pairings, 25 charts, and 17 stacks (React, Next.js, Vue, Nuxt.js, Nuxt UI, Svelte, Astro, SwiftUI, React Native, Flutter, Tailwind, shadcn/ui, Jetpack Compose, Angular, Laravel, JavaFX, Three.js). Use when designing, building, or reviewing UI: pages, components, color schemes, typography, layout, accessibility, animation, or data visualization.",
"version": "2.6.2",
"author": {
"name": "nextlevelbuilder"
},
"license": "MIT",
"keywords": ["ui", "ux", "design", "styles", "typography", "color-palette", "accessibility", "charts", "components"],
"skills": "./.claude/skills/"
}