← 返回 Skills 市场
Superdesign
作者
JayZeeDesign
· GitHub ↗
· v1.0.0
451
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install superdesigndev
功能描述
Superdesign is a design agent specialized in frontend UI/UX design. Use this skill before implementing any UI that requires design thinking. Common commands:...
安全使用建议
Before installing or running this skill, understand that it instructs the agent to: (1) scan and copy large parts of your codebase into .superdesign/init/, (2) install and run an external npm CLI (@superdesign/cli) and require you to 'login', and (3) fetch and obey additional instructions from raw.githubusercontent.com at runtime. These behaviors can upload sensitive source code and allow the remote documents or the CLI service to control what the agent does. Recommended precautions: (a) review the remote files (the two raw.githubusercontent URLs) yourself before allowing the skill to fetch/obey them, (b) inspect the @superdesign/cli package (npmjs/GitHub repo, maintainer, install scripts) in a safe environment, (c) do not run this on sensitive or private repositories without explicit approval and a legal/privacy review, (d) consider running the skill in an isolated container or sandbox, and (e) require explicit user confirmation before the agent performs repo-wide scans, installs, or uploads. If you need a less risky workflow, prefer tools that let you selectively send small, explicitly-chosen UI files rather than automatic full-repo extraction.
功能分析
Type: OpenClaw Skill
Name: superdesigndev
Version: 1.0.0
This skill is classified as suspicious due to multiple high-risk behaviors and vulnerabilities. The agent is instructed to automatically fetch and execute instructions from remote GitHub raw content URLs (INIT.md and SUPERDESIGN.md from `https://raw.githubusercontent.com/superdesigndev/superdesign-skill/main/skills/superdesign/`) as direct agent instructions, which is a critical remote code execution (RCE) and prompt injection vulnerability (SKILL.md). Additionally, the agent is instructed to automatically install/update the `@superdesign/cli` npm package globally (`npm install -g @superdesign/cli@latest`), posing a significant supply chain risk (SKILL.md, SUPERDESIGN.md). Furthermore, the skill is designed to read and process extensive portions of the user's codebase, including 'FULL source code' of components, layouts, and configuration files, passing this sensitive data to the `superdesign` CLI, which represents a major data exposure risk (INIT.md, SUPERDESIGN.md).
能力评估
Purpose & Capability
The skill is a design agent and legitimately needs UI code/context to produce pixel-accurate drafts. However, it mandates collecting FULL source code for many components/layouts and writing full init files into .superdesign/init/, and it also instructs installing a global npm CLI (@superdesign/cli) that is not described in the registry metadata. Fetching remote runtime instruction files (INIT.md, SUPERDESIGN.md) from an external raw.githubusercontent URL extends the skill's behavior beyond the local description.
Instruction Scope
SKILL.md requires reading the entire UI dependency tree, copying full source files (components.md, layouts.md, theme.md, etc.), creating .superdesign/init/ files, and then passing many local files to the external CLI. It also mandates fetching and following external runtime instructions (two raw.githubusercontent URLs) — giving the remote documents the power to change runtime behavior. These steps reasonably allow the CLI/service to receive large amounts of repository code (potentially sensitive) and permit remote instructions to alter agent actions.
Install Mechanism
There is no declared install spec in the registry, but SKILL.md instructs the agent to run `npm install -g @superdesign/cli@latest` if the CLI is missing. Installing an unsigned/undeclared global npm package at runtime is a moderate-to-high risk vector (unknown package provenance, post-install scripts, etc.). The skill does not document verifying the package source or provide alternative vetted install methods.
Credentials
The skill declares no required environment variables or credentials, but it requires the user/agent to run `superdesign login` and to ensure the CLI is logged in before use. That login step will create credentials/tokens (not declared or scoped here) and is necessary for the CLI to communicate with its backend. The lack of declared envs/tokens is not strictly inconsistent, but it means authentication will be interactive and the user should understand what account/service will receive uploaded context.
Persistence & Privilege
The skill does not request always-on or system-wide privileges and is user-invocable only. Its operations involve creating/reading files under the project (.superdesign/init/) which is expected for a repo-scanning design tool. It does not attempt to modify other skills or global agent settings.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install superdesigndev - 安装完成后，直接呼叫该 Skill 的名称或使用
/superdesigndev触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of the Superdesign skill:
- Renamed from "frontend-design" to "superdesign" with a new focus on procedural UI/UX design agent workflows.
- Adds strict repo analysis via superdesign init, requiring automated creation and population of `.superdesign/init/` context files before any design task.
- Enforces step-by-step CLI usage, including installation and authentication checks before any superdesign command runs.
- Documents supported CLI commands and usage patterns for managing projects, drafts, components, and design iterations.
- Requires fetching and following remote guideline files (INIT.md, SUPERDESIGN.md) for always up-to-date instructions.
元数据
常见问题
Superdesign 是什么？
Superdesign is a design agent specialized in frontend UI/UX design. Use this skill before implementing any UI that requires design thinking. Common commands:... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 451 次。
如何安装 Superdesign？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install superdesigndev」即可一键安装，无需额外配置。
Superdesign 是免费的吗？
是的，Superdesign 完全免费（开源免费），可自由下载、安装和使用。
Superdesign 支持哪些平台？
Superdesign 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Superdesign？
由 JayZeeDesign（@jayzeedesign）开发并维护，当前版本 v1.0.0。
推荐 Skills