https://skills.sh/nextlevelbuilder/ui-ux-pro-max-skill/ui-ux-pro-max
ui-ux-pro-max
Risky
Score 46 / 100 · 71 files read · 0 critical, 1 high, 5 medium, 4 low findings
Report 9bb7d39d07d9fc9e · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version
Subscores
100 is clean. Deductions come only from the cited findings below.
Findings
highThis package both touches credential material and sends data over the network (in different files) — review the flow before installing
(package) · line 1 · rule H1
mediumCode contacts example.com, which the documentation never mentions
(package) · line 1 · rule M3
example.com
mediumEnumerates the full process environment (all variables, not one named key)
scripts/tests/test_catalog_refresh.py · line 70 · rule M2
] env = dict(os.environ) env.pop("GOOGLE_FONTS_API_KEY", None) result = self.run_command(*args
mediumCan run shell commands from code
scripts/tests/test_catalog_refresh.py · line 26 · rule M1
ne): return subprocess.run( [sys.executable, *map(str, args)], cwd=REPO, env=env,
mediumCan run shell commands from code
scripts/tests/test_core.py · line 256 · rule M1
processes = [subprocess.Popen( [sys.executable, str(search_script), f"saas dashboard {index}",
mediumCan run shell commands from code
scripts/tests/test_design_system_stack.py · line 34 · rule M1
ows. return subprocess.run( [sys.executable, str(SEARCH), *map(str, args)], capture_output=True,
lowUnusually large file in the package (0.7 MB) — bulk can hide a payload; we did not parse it
data/google-fonts.csv · line 1 · rule L3
0.7 MB
lowUnusually large file in the package (0.8 MB) — bulk can hide a payload; we did not parse it
data/phosphor-icons-upstream.json · line 1 · rule L3
0.8 MB
lowReads named environment variables (normal for API keys; listed in the permission summary)
scripts/design_system.py · line 640 · rule L1
"" colorterm = os.environ.get('COLORTERM', '') if colorterm not in ('truecolor', '24bit'): return "" hex_colo
lowReads named environment variables (normal for API keys; listed in the permission summary)
scripts/tests/test_catalog_refresh.py · line 70 · rule L1
env = dict(os.environ) env.pop("GOOGLE_FONTS_API_KEY", None) result = self.run_command(*args, env
Permission surface
- Network endpoints
- accessibilityinsights.ioangular.devapi.example.comapi.flutter.devcallstack.github.iocarbondesignsystem.comcdn.jsdelivr.netcdnjs.cloudflare.comcontrolsfx.github.iodesign-system.service.gov.ukdeveloper.android.comdeveloper.apple.comdeveloper.mozilla.orgdevelopers.google.comdocs.astro.builddocs.avaloniaui.netdocs.expo.devdocs.flutter.devdocs.oracle.comdocs.swmansion.comevil.exampleexample.comfluent2.microsoft.designfonts.google.comfonts.googleapis.comfonts.gstatic.comgithub.comgsap.cominertiajs.comjavafx.comkit.svelte.devkordamp.orglaravel.comlearn.microsoft.comlivewire.laravel.comm3.material.iomaterial.angular.iomkpaz.github.ionextjs.orgngrx.ionuxt.comopenjfx.ioopensource.adobe.compinia.vuejs.orgplatform.unopub.devreact.devreactnative.devreactnavigation.orgriverpod.devrouter.vuejs.orgs2.spectrum.adobe.comschemas.microsoft.comshopify.devsvelte.devtailwindcss.comtest-utils.vuejs.orgtesting-library.comthreejs.orgui.nuxt.comui.shadcn.comvuejs.orgwix.github.iowww.npmjs.comwww.w3.org
- Environment read
- API_SECRETCOLORTERMDATABASE_URLNUXT_PUBLIC_API_BASE
- Shell execution
- yes — code or scripts can run shell commands
- Install hooks
- none
- Credential material
- Reads named environment variables (normal for API keys; listed in the permission summary)
Enumerates the full process environment (all variables, not one named key)
Provenance
- Source
- GitHub
- Repository
- nextlevelbuilder/ui-ux-pro-max-skill
- Owner
- nextlevelbuilder
- Stars
- 141795
- Forks
- 15019
- Repo created
- 2025-11-30
- Last push
- 2026-10-26
- License
- MIT
Watch this package
Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.
Share this report: https://preflight.orbitaldeskllc.com/r/9bb7d39d07d9fc9e