Agent Economy ReportAgent Economy ReportCAUTION version 0.1.0 · audited 2026-09-17
This package is a UI/UX design reference skill. It contains workflow instructions and large CSV data files with design guidance, code examples, and documentation URLs. The skill tells an agent to read its bundled data files and optionally run a bundled Python script to generate design tokens. No network calls, credential collection, data exfiltration, or persistence behavior is implemented in the files provided. The main reason for caution is that the Python script is referenced but not included in the audited file set, so its behavior cannot be verified before an agent runs it.
| Declared purpose | UI/UX design intelligence and implementation guidance for building polished interfaces. Use when the user asks for UI design, UX flows, information architecture, visual style direction, design systems/tokens, component specs, copy/microcopy, accessibility, or to generate/critique/refine frontend UI (HTML/CSS/JS, React, Next.js, Vue, Svelte, Tailwind). Includes workflows for (1) generating new UI layouts and styling, (2) improving existing UI/UX, (3) producing design-system tokens and component guidelines, and (4) turning UX recommendations into concrete code changes. |
| Observed behavior | The skill instructs the agent to triage the request, read bundled data files under assets/data and a bundled upstream reference, optionally run a bundled Python design-system script, and produce design or implementation guidance. The provided package files are mostly static CSV reference data plus SKILL.md instructions. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: API_SECRET; touches persistence (cron, shell profile, autostart); uses sudo, rm -rf or dd |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_read | needed | SKILL.md lines 28-29 instruct reading bundled CSV data and upstream reference markdown for design guidance. |
| shell | needed | SKILL.md lines 34-35 and 38 instruct or recommend running python3 skills/ui-ux-pro-max/scripts/design_system.py --help. The script itself is not present in the audited files. |
| network | exceeds purpose | Data files contain documentation URLs such as nextjs.org and react.dev, but the skill does not instruct the agent to make network requests. |
| credentials | exceeds purpose | Some CSV code examples mention API_SECRET and runtime config secrets, but the package does not ask the agent to read or transmit credentials. |
| payments | exceeds purpose | Deterministic facts list a paypal.me domain in references/upstream-README.md line 15. This appears to be reference material and is not used by the skill logic. |
| severity | finding |
|---|---|
| info | Reads bundled design data The skill instructs the agent to read its own CSV files under assets/data. This matches the declared purpose. SKILL.md:28 - **Design intelligence data**: Read from `skills/ui-ux-pro-max/assets/data/` when you need palettes, patterns, or UI/UX heuristics. |
| medium | Bundled Python script execution The skill instructs the agent to run a Python script bundled in the package. The script file is not included in the audited package files, so its actual behavior is unverified. Users should inspect it before allowing execution in a credential-holding agent. SKILL.md:35 python3 skills/ui-ux-pro-max/scripts/design_system.py --help |
| low | Script use is recommended This line nudges the agent to run the unverified script for token output. Optional but increases the need for caution. SKILL.md:38 Prefer running it when the user wants a structured token output (ASCII-friendly). |
| info | Example contains secret-like environment variable This CSV row shows how to override Nuxt runtime config with environment variables, using NUXT_API_SECRET and NUXT_PUBLIC_API_BASE=https://api.example.com as examples. It is documentation data, not code that collects or sends secrets. assets/data/stacks/nuxtjs.csv:53 53,Environment,Use NUXT_ prefix for env override,Override config with environment variables,NUXT_API_SECRET NUXT_PUBLIC_API_BASE,Custom env var names,NUXT_PUBLI |
| info | Secrets kept in private config The row directs server-only secrets to runtimeConfig root and warns against putting secrets in public config. assets/data/stacks/nuxtjs.csv:55 55,Environment,Keep secrets in private config,Server-only secrets in runtimeConfig root,runtimeConfig.apiSecret (server only),Secrets in public config,runtimeCo |
1 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.example.com | not in the service index | assets/data/stacks/nuxtjs.csv:54 |
| api.flutter.dev | not in the service index | assets/data/stacks/flutter.csv:2 |
| api.star-history.com | not in the service index | references/upstream-README.md:484 |
| callstack.github.io | not in the service index | assets/data/stacks/react-native.csv:47 |
| cdn.example.com | not in the service index | assets/data/web-interface.csv:20 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| dart.dev | not in the service index | assets/data/stacks/flutter.csv:4 |
| developer.android.com | not in the service index | assets/data/stacks/jetpack-compose.csv:2 |
| developer.apple.com | not in the service index | assets/data/stacks/swiftui.csv:2 |
| docs.astro.build | not in the service index | assets/data/stacks/astro.csv:2 |
| docs.expo.dev | not in the service index | assets/data/stacks/react-native.csv:29 |
| docs.flutter.dev | not in the service index | assets/data/stacks/flutter.csv:43 |
| docs.swmansion.com | not in the service index | assets/data/stacks/react-native.csv:38 |
| example.com | not in the service index | assets/data/stacks/astro.csv:50 |
| fonts.google.com | not in the service index | assets/data/typography.csv:2 |
| fonts.googleapis.com | not in the service index | assets/data/typography.csv:2 |
| github.com | not in the service index | assets/data/stacks/html-tailwind.csv:49 |
| img.shields.io | not in the service index | references/upstream-README.md:4 |
| kit.svelte.dev | not in the service index | assets/data/stacks/svelte.csv:42 |
| nextjs.org | not in the service index | assets/data/stacks/nextjs.csv:2 |
| nuxt.com | not in the service index | assets/data/stacks/nuxtjs.csv:2 |
| paypal.me | not in the service index | references/upstream-README.md:15 |
| pinia.vuejs.org | not in the service index | assets/data/stacks/vue.csv:30 |
| pub.dev | not in the service index | assets/data/stacks/flutter.csv:20 |
| react.dev | not in the service index | assets/data/stacks/react.csv:2 |
| reactnative.dev | not in the service index | assets/data/stacks/react-native.csv:2 |
| reactnavigation.org | not in the service index | assets/data/stacks/react-native.csv:11 |
| riverpod.dev | not in the service index | assets/data/stacks/flutter.csv:9 |
| router.vuejs.org | not in the service index | assets/data/stacks/vue.csv:33 |
| star-history.com | not in the service index | references/upstream-README.md:484 |
| svelte.dev | not in the service index | assets/data/stacks/svelte.csv:2 |
| tailwindcss.com | not in the service index | assets/data/stacks/html-tailwind.csv:2 |
| test-utils.vuejs.org | not in the service index | assets/data/stacks/vue.csv:43 |
| testing-library.com | not in the service index | assets/data/stacks/react.csv:42 |
| ui.nuxt.com | not in the service index | assets/data/stacks/nuxt-ui.csv:2 |
| ui.shadcn.com | not in the service index | assets/data/stacks/shadcn.csv:2 |
| vuejs.org | not in the service index | assets/data/stacks/vue.csv:2 |
| wix.github.io | not in the service index | assets/data/stacks/react-native.csv:49 |
| www.npmjs.com | not in the service index | references/upstream-README.md:12 |
| Binaries invoked | bash, git, node, npm, npx, powershell, python, python3, sudo |
| Environment variables read | API_SECRET, DATABASE_URL, NUXT_PUBLIC_API_BASE |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 20 |
| Persistence | 10 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 43 | e3048deafc62fb65… |
_meta.json | 6 | 4e177779eb5db460… |
assets/data/charts.csv | 26 | b754c0efffcf54cb… |
assets/data/colors.csv | 97 | 4cc0df2785f340b8… |
assets/data/icons.csv | 101 | 351fe61ba45b8146… |
assets/data/landing.csv | 31 | 010e1e46db271b94… |
assets/data/products.csv | 97 | 5359e3037dcb84e9… |
assets/data/react-performance.csv | 45 | 904c8afcda229629… |
assets/data/stacks/astro.csv | 54 | ad18dae3ab6d148d… |
assets/data/stacks/flutter.csv | 53 | e470e6bc2bcd8562… |
assets/data/stacks/html-tailwind.csv | 56 | 1f004891dd189f6b… |
assets/data/stacks/jetpack-compose.csv | 53 | 6c8fd4b0391c342c… |
assets/data/stacks/nextjs.csv | 53 | 06a8e8c13bd44696… |
assets/data/stacks/nuxt-ui.csv | 51 | 05d6e74501b2b6a6… |
assets/data/stacks/nuxtjs.csv | 59 | f7a3f2d9542856d0… |
assets/data/stacks/react-native.csv | 52 | a08ca77fcf6b6d95… |
assets/data/stacks/react.csv | 54 | b6e3eb0e4c9c01bd… |
assets/data/stacks/shadcn.csv | 61 | 395c2e415ef6f48a… |
assets/data/stacks/svelte.csv | 54 | bc8d158994a8bdf4… |
assets/data/stacks/swiftui.csv | 51 | e87cb9eee208bb75… |
assets/data/stacks/vue.csv | 50 | 9b793c3f4eec85f7… |
assets/data/styles.csv | 68 | ad3c3236134d833b… |
assets/data/typography.csv | 58 | 64695e05ac335ba5… |
assets/data/ui-reasoning.csv | 101 | 58fc52fff69f6270… |
assets/data/ux-guidelines.csv | 100 | 1870ee048f2a2bdd… |
assets/data/web-interface.csv | 31 | 10bfc24e09a6a15d… |
data/charts.csv | 26 | b754c0efffcf54cb… |
data/colors.csv | 97 | 4cc0df2785f340b8… |
data/icons.csv | 101 | 351fe61ba45b8146… |
data/landing.csv | 31 | 010e1e46db271b94… |
data/products.csv | 97 | 5359e3037dcb84e9… |
data/react-performance.csv | 45 | 904c8afcda229629… |
data/stacks/astro.csv | 54 | ad18dae3ab6d148d… |
data/stacks/flutter.csv | 53 | e470e6bc2bcd8562… |
data/stacks/html-tailwind.csv | 56 | 1f004891dd189f6b… |
data/stacks/jetpack-compose.csv | 53 | 6c8fd4b0391c342c… |
data/stacks/nextjs.csv | 53 | 06a8e8c13bd44696… |
data/stacks/nuxt-ui.csv | 51 | 05d6e74501b2b6a6… |
data/stacks/nuxtjs.csv | 59 | f7a3f2d9542856d0… |
data/stacks/react-native.csv | 52 | a08ca77fcf6b6d95… |
data/stacks/react.csv | 54 | b6e3eb0e4c9c01bd… |
data/stacks/shadcn.csv | 61 | 395c2e415ef6f48a… |
data/stacks/svelte.csv | 54 | bc8d158994a8bdf4… |
data/stacks/swiftui.csv | 51 | e87cb9eee208bb75… |
data/stacks/vue.csv | 50 | 9b793c3f4eec85f7… |
data/styles.csv | 68 | ad3c3236134d833b… |
data/typography.csv | 58 | 64695e05ac335ba5… |
data/ui-reasoning.csv | 101 | 58fc52fff69f6270… |
data/ux-guidelines.csv | 100 | 1870ee048f2a2bdd… |
data/web-interface.csv | 31 | 10bfc24e09a6a15d… |
references/upstream-README.md | 488 | b8cca8dbb183bcf8… |
references/upstream-skill-content.md | 288 | 4e495d54b006e213… |
scripts/__init__.py | 0 | e3b0c44298fc1c14… |
scripts/core.py | 253 | 5459d1f04eea03df… |
scripts/design_system.py | 1071 | 1f8d1961c9166fe4… |
scripts/search.py | 111 | 8ef258d6aed922f4… |
skill-card.md | 54 | 32cc46f36bea987b… |
The package exceeded the reading budget; the AI saw a truncated copy. The deterministic pass covered every text file.
For agents
JSON: https://agenteconomy.report/k/ui-ux-pro-max.audit.json · badge: https://agenteconomy.report/k/ui-ux-pro-max.audited.svg ·
skill rating: /k/ui-ux-pro-max · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).