UI/UX Design Guide

• Risk level: Low
• Analyzed: May 1, 2026, 5:22 AM
• Findings: 1
• Version: 1.0.0

Overview

This is a benign UI/UX guidance skill; its only notable security consideration is optional npm setup commands users should run deliberately.

This skill appears safe as an instruction-only UI/UX reference. If you follow its project setup snippets, treat them like any npm-based scaffolding command: run them intentionally, in a clean project directory, and review the generated files before committing or deploying.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

If the user runs these commands, external npm packages may create or modify project files and install dependencies.

Why it was flagged

These are user-facing setup examples that would retrieve and execute npm packages at their latest versions if run. This is purpose-aligned for setting up a Tailwind/Shadcn UI project, but users should recognize it as external package execution.

Skill content

npx create-next-app@latest project-name --typescript --tailwind --app ... npx shadcn@latest init

Recommendation

Run the setup commands only in the intended project directory, review generated changes, and pin package versions if reproducibility or supply-chain control matters.