Agent skill · Audited from source

typeui-fundamentals

skill · bergside/typeuiNOASSERTION licenceAudited 20 Oct 2026 · source 5dcf760c4728

★ 2,089pushed 108 days ago
✕BLOCKGrade D · 69/100 · 8 findings · 5dcf760
2,089repo stars · whole bergside/typeui

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 5dcf760c4728 and observed network and shell access and no hard-coded secrets. The audit raised 8 findings, 2 critical or high. What it does: Universal UI/UX design principles covering visual hierarchy, interaction laws, typography foundations, and WCAG accessibility requirements. Use when making design decisions not covered by a specific design system,…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “typeui-fundamentals (bergside/typeui)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/bergside/typeui-fundamentals

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Code injection” in src/prompts/designSystem.ts:19. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score69/100✕BLOCK D
0 critical2 high3 medium3 low0 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared2 observations
  • ShellDeclared2 observations
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN3
L1 Static sourceSecrets, path traversal, supply chain, hidden codeFAIL5
L2 InstructionsPrompt injection, authority framing, hidden directivesPASS0
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (8)

HIGHCode injectioncode.eval_exec · src/prompts/designSystem.ts:19
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const dynamicImport = new Function(
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/prompts/registry.ts:7
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const dynamicImport = new Function("specifier", "return import(specifier)") as (
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
MEDIUMInventory / provenanceinv.binary · plugins/hermes/typeui/typeui_hermes/__pycache__/__init__.cpython-313.pyc
F-13 Inventory / provenanceCWE-1104Layer L0
__init__.cpython-313.pyc
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · plugins/hermes/typeui/typeui_hermes/__pycache__/schemas.cpython-313.pyc
F-13 Inventory / provenanceCWE-1104Layer L0
schemas.cpython-313.pyc
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · plugins/hermes/typeui/typeui_hermes/__pycache__/tools.cpython-313.pyc
F-13 Inventory / provenanceCWE-1104Layer L0
tools.cpython-313.pyc
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
commander, inquirer, zod, @types/node, tsx, typescript, vitest
Why
7 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · plugins/openclaw/typeui/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
typebox
Why
1 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · plugins/opencode/typeui/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@opencode-ai/plugin
Why
1 dependency range(s) float
Fix
pin exact versions or ship a lockfile

Audit 0.4.1 · source sha 5dcf760c4728 · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherbergside GitHub organizationOwner of the repository this skill is read from
  • Source folderbergside/typeuiThe exact folder we audited
  • LicenceNOASSERTIONAs the repository states it
  • Commit pinned for this verdict5dcf760c4728A new audit runs when the source changes
  • Repository statusNot archivedLast push 108 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Universal UI/UX design principles covering visual hierarchy, interaction laws, typography foundations, and WCAG accessibility requirements. Use when making design decisions not covered by a specific design system,…

---
name: typeui-fundamentals
description: Universal UI/UX design principles covering visual hierarchy, interaction laws, typography foundations, and WCAG accessibility requirements. Use when making design decisions not covered by a specific design system, validating principle compliance, or resolving conflicts between aesthetics and accessibility. Design-system-agnostic and applies to every surface.
license: MIT
metadata:
  author: typeui.sh
---

# Design Fundamentals — Agent Instructions

Universal design principles that define **why** patterns work, **how** to apply them correctly, and **what** accessibility requirements are non-negotiable. These are timeless, design-system-agnostic foundations that apply to every surface regardless of vertical or workflow phase.

## Load order

Read these files **after** loading the design system (`SKILL.md` / `DESIGN.md` + token modules). The design system tells you *what* token to use; these files explain *why* that decision is correct and *how* to avoid common principle violations.

## Module index

| File | Purpose |
|---|---|
| [ui-principles.md](ui-principles.md) | Universal visual design principles — hierarchy, layout rhythm, typography placement, color theory, depth & layering, interaction design, responsive adaptation, component behavior |
| [spacing-principles.md](spacing-principles.md) | Spacing-specific principles — 4-point grid, proximity grouping, inner vs outer gaps, vertical and horizontal rhythm, heading→paragraph spacing, section and component spacing tiers |
| [ux-principles.md](ux-principles.md) | Interaction & control principles — 30 UX laws, button/control state contracts (9 states), hover/active technique palettes, touch targets, cognitive load, feedback loops |
| [typography-principles.md](typography-principles.md) | Typography-specific principles — type system foundations, scale & modular ratios, readability & measure, accessibility, responsive type, brand tone expression through type |
| [accessibility.md](accessibility.md) | WCAG 2.1/2.2 compliance — contrast ratios, color-as-information rules, focus visibility, keyboard navigation, motion safety, target sizes, text spacing, semantic structure, ARIA |

## What these files are NOT

These files do not define:
- **Workflow phases** (think → build → check → ship) — see `skills/vertical/SKILL.md`
- **Quality gates or audits** — see `skills/vertical/inspect.md`, `review.md`, `preflight.md`
- **Anti-pattern catalogs** — see `skills/vertical/anti-patterns.md`
- **Industry-specific content** — see `skills/vertical/team-social-saas.md`
- **Design tokens or component specs** — see `skills/design-system/SKILL.md`

## Conflict resolution

When sources disagree:

1. **Design system** wins for concrete values (colors, sizes, spacing tokens, component specs).
2. **Fundamentals** (this layer) win for structural principles (hierarchy, accessibility, motion logic).
3. **Vertical** wins for process decisions AND content architecture (section order, required sections, industry tone).

Accessibility is non-negotiable at every level — it overrides aesthetic preferences everywhere.

## When the design system is silent, these principles decide

Any design decision not covered by the system's tokens or component rules falls back to the principles here. Never contradict the design system — if a principle and a design-system rule conflict, the design system wins. Flag the conflict for review.

Excerpt, first 3,441 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 5dcf760

npx skills add https://github.com/bergside/typeui --skill typeui-fundamentals
npm install
claude plugin install typeui@bergside
pip install .

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 5dcf760c4728 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
WindsurfMentioned in its text, not testedSkills for Windsurf · About Windsurf
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 5dcf760c4728

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/bergside/typeui-fundamentals/badge.svg)](https://modelsatlas.com/skills/bergside/typeui-fundamentals/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/bergside/typeui-fundamentals/badge.svg)](https://modelsatlas.com/skills/bergside/typeui-fundamentals/)

Questions about typeui-fundamentals

What does the typeui-fundamentals skill do?
Build better UI with AI
Is typeui-fundamentals safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can typeui-fundamentals access on my machine?
The audit observed that it reaches the network and runs shell commands. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does typeui-fundamentals work with?
Its documentation mentions claude-code, codex, copilot, cursor, openclaw and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (5dcf760c4728), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.