UI Craft Pro

Design, refine, and implement better UI for websites, dashboards, apps, landing pages, and components by using a local design knowledge base plus a code-firs...

This skill appears to be a local design & code assistant that ships with a large offline knowledge base and Python scripts. That is coherent with its description, but it contains two things you should check before use: (1) open and read SKILL.md completely for any instructions that ask the agent to change its system prompt or to send data to an external endpoint — the pre-scan flagged a possible prompt-injection phrase; (2) inspect the bundled Python scripts (scripts/*.py and data/_sync_all.py) for network calls (requests, urllib, sockets), subprocess.exec usage, or file operations outside the skill folder. If you aren't comfortable auditing the code, run the scripts in a restricted environment (container, VM) with no secret credentials mounted and no sensitive files accessible. Do not run them with elevated privileges or in a workspace where they can access other users' files or cloud credentials. If you plan to let the agent invoke the skill autonomously, be extra cautious: autonomous execution plus bundled code and a prompt-injection pattern increases blast radius. If you want, I can scan the remaining script files for network or subprocess patterns and summarize any risky calls I find.

Type: OpenClaw Skill Name: ui-craft-pro Version: 0.2.2 The bundle is a comprehensive UI/UX design toolkit that includes a file-writing feature in `scripts/design_system.py` (via `persist_design_system`) to save design specifications. While this capability is aligned with the stated purpose of 'persisting' a design system, the implementation lacks strict path sanitization on the `project_name` and `page` parameters, which could potentially be exploited for path traversal. No evidence of intentional malice, data exfiltration, or backdoors was found in the code or the `SKILL.md` instructions.