OpenUI Workspace Delivery

Teach an agent how to install OpenUI MCP Studio, connect it to a host, and use the core UI generation and review workflow without overclaiming a live marketp...

Security Scan

The packet is largely coherent for installing and running a local OpenUI MCP Studio, but it references a sensitive GEMINI_API_KEY secret in its runtime instructions while declaring no required environment variables — a mismatch worth flagging before use.

Purpose & Capability

Name, description, and bundled files consistently describe a local MCP-first UI install/proof workflow. The listed commands, demo, and troubleshooting all align with that purpose.

Instruction Scope

SKILL.md and the reference docs direct the agent to clone the repo, run npm install/build, replace placeholder absolute paths, and run repo-local MCP commands and proof loops. Those actions are within the stated purpose. However the instructions explicitly reference a GEMINI_API_KEY secret and ask the agent to report whether it is available — the skill will therefore interact with sensitive config data not declared in the manifest.

Install Mechanism

This is an instruction-only skill with no install spec and no bundled executable downloads; the only external network action suggested is cloning a GitHub repo (a standard public host). No extract-from-arbitrary-URL installs are present.

Credentials

The skill's files and runtime instructions require provision of a GEMINI_API_KEY (present in host config snippets and instructions), but the skill metadata declares no required env variables or primary credential. Asking for a single API key is plausible for integration with a model service, but the manifest/instructions mismatch is an incoherence and the key is sensitive — the packet instructs the agent to check and report on its presence, which could lead to accidental exposure if not handled carefully.

Persistence & Privilege

The skill has no always:true flag, is user-invocable, and does not request persistent system-wide modifications or other skills' configs. Allowing autonomous invocation is the platform default and is not, by itself, an additional concern here.

What to consider before installing

This skill appears to be a coherent, repo-owned guide for installing a local OpenUI MCP Studio, but it expects you to supply a GEMINI_API_KEY (a sensitive API key) even though the skill's manifest lists no required env vars. Before installing: (1) verify the GitHub repo and code you will build; (2) do not paste your API key into chat — prefer configuring it in the host/agent config or a secure environment variable; (3) provide a least-privilege/ephemeral key if possible; (4) consider updating the manifest to declare the GEMINI_API_KEY requirement or confirm with the skill author why it is omitted; and (5) be cautious if the agent is asked to report or log the key — avoid printing secrets in agent outputs.

Teach the agent how to install, connect, and use OpenUI MCP Studio as a local MCP-first UI generation and review workspace.

Use this skill when

• the user wants to generate or review shadcn-style UI from a local MCP server
• the host can run a local stdio MCP server
• the user wants one inspectable proof loop before any public claim

What this packet teaches

• how to wire the local OpenUI MCP server into OpenHands or OpenClaw
• which OpenUI MCP tools are safe and useful first
• how to move from installation to a first proof loop
• how to keep claims grounded in local MCP and repo-owned proof instead of marketplace hype

Start here

1. Read references/INSTALL.md
2. Load the right host config from:
   • references/OPENHANDS_MCP_CONFIG.json
   • references/OPENCLAW_MCP_CONFIG.json
3. Skim the tool surface in references/CAPABILITIES.md
4. Run the proof loop in references/DEMO.md
5. If attach or proof fails, use references/TROUBLESHOOTING.md

Recommended workflow

1. openui_scan_workspace_profile
2. openui_plan_change
3. openui_generate_ui
4. openui_quality_gate
5. openui_build_review_bundle

Suggested first prompt

Use OpenUI MCP Studio to inspect this workspace and prepare one safe-first UI delivery step. Start with openui_scan_workspace_profile and openui_plan_change. If the workspace looks healthy, run openui_generate_ui for one small component or page change, then run openui_quality_gate and summarize what a reviewer should inspect next.

Success checks

• the host can launch the OpenUI MCP server from the provided config
• the workspace scan returns a real profile instead of placeholder text
• the plan/generate flow yields a concrete UI output or change plan
• the proof loop stays inside local MCP and repo-owned evidence

Boundaries

• OpenUI MCP Studio stays a local MCP and repo-owned proof workflow
• this packet does not claim a live ClawHub listing or a vendor marketplace listing
• this packet does not claim a hosted runtime or hosted API publication