UI / UX

Searchable UI/UX design databases: 50+ styles, 97 palettes, 57 font pairings, 99 UX rules, 25 chart types. CLI generates design systems from natural language. Data-driven complement to ui-design.

This skill appears to be a locally run Python CLI that uses bundled CSV databases to generate design systems — that matches its description. However before installing or running it you should: 1) Inspect the Python scripts (scripts/search.py, core.py, design_system.py) for any network requests, remote endpoints, or unexpected filesystem access. 2) Confirm the install source/provenance (who published it and whether the GitHub URL in the README is legitimate). 3) Because SKILL.md requires python3 but the registry entry doesn't list python as a required binary, ensure you run the CLI in a controlled environment (virtualenv or container) and not with elevated privileges. 4) If you plan to use the persistence features, be aware the tool will write files under the current project and the README suggests copying files into ~/.ai-skills or other home directories — only do that after manual review. If you cannot review the scripts yourself, run them in an isolated sandbox or ask the publisher for a signed release or source repository to review.

Type: OpenClaw Skill Name: ui-ux Version: 1.0.0 The skill is generally benign, providing UI/UX design recommendations. However, a significant file write vulnerability exists in `scripts/design_system.py` and `scripts/search.py`. The `--output-dir` CLI argument, which is user-controlled, is directly used to construct the base path for writing `MASTER.md` and page-specific markdown files. This allows an attacker or a prompt-injected agent to attempt to write files to arbitrary directories on the system (e.g., `/etc/design-system/MASTER.md` or `~/.ssh/design-system/MASTER.md`), even though the content written is benign markdown and the filenames are sanitized. This lack of path validation for user-supplied input constitutes a high-risk vulnerability.