Agent skill · Audited from source
typeui-fundamentals
skill · bergside/typeuiNOASSERTION licenceAudited 20 Oct 2026 · source 5dcf760c4728
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 5dcf760c4728 and observed network and shell access and no hard-coded secrets. The audit raised 8 findings, 2 critical or high. What it does: Universal UI/UX design principles covering visual hierarchy, interaction laws, typography foundations, and WCAG accessibility requirements. Use when making design decisions not covered by a specific design system,…
Cite
Cite this page
ModelsAtlas. “typeui-fundamentals (bergside/typeui)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/bergside/typeui-fundamentals
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Code injection” in src/prompts/designSystem.ts:19. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkDeclared2 observations
- ShellDeclared2 observations
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 3 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | FAIL | 5 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (8)
HIGHCode injectioncode.eval_exec · src/prompts/designSystem.ts:19
const dynamicImport = new Function(
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/prompts/registry.ts:7
const dynamicImport = new Function("specifier", "return import(specifier)") as (- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
MEDIUMInventory / provenanceinv.binary · plugins/hermes/typeui/typeui_hermes/__pycache__/__init__.cpython-313.pyc
__init__.cpython-313.pyc
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · plugins/hermes/typeui/typeui_hermes/__pycache__/schemas.cpython-313.pyc
schemas.cpython-313.pyc
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · plugins/hermes/typeui/typeui_hermes/__pycache__/tools.cpython-313.pyc
tools.cpython-313.pyc
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
LOWSupply chainsupply.unpinned · package.json
commander, inquirer, zod, @types/node, tsx, typescript, vitest
- Why
- 7 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · plugins/openclaw/typeui/package.json
typebox
- Why
- 1 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · plugins/opencode/typeui/package.json
@opencode-ai/plugin
- Why
- 1 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
Audit 0.4.1 · source sha 5dcf760c4728 · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherbergside GitHub organizationOwner of the repository this skill is read from
- Source folderbergside/typeuiThe exact folder we audited
- LicenceNOASSERTIONAs the repository states it
- Commit pinned for this verdict5dcf760c4728A new audit runs when the source changes
- Repository statusNot archivedLast push 108 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Universal UI/UX design principles covering visual hierarchy, interaction laws, typography foundations, and WCAG accessibility requirements. Use when making design decisions not covered by a specific design system,…
--- name: typeui-fundamentals description: Universal UI/UX design principles covering visual hierarchy, interaction laws, typography foundations, and WCAG accessibility requirements. Use when making design decisions not covered by a specific design system, validating principle compliance, or resolving conflicts between aesthetics and accessibility. Design-system-agnostic and applies to every surface. license: MIT metadata: author: typeui.sh --- # Design Fundamentals — Agent Instructions Universal design principles that define **why** patterns work, **how** to apply them correctly, and **what** accessibility requirements are non-negotiable. These are timeless, design-system-agnostic foundations that apply to every surface regardless of vertical or workflow phase. ## Load order Read these files **after** loading the design system (`SKILL.md` / `DESIGN.md` + token modules). The design system tells you *what* token to use; these files explain *why* that decision is correct and *how* to avoid common principle violations. ## Module index | File | Purpose | |---|---| | [ui-principles.md](ui-principles.md) | Universal visual design principles — hierarchy, layout rhythm, typography placement, color theory, depth & layering, interaction design, responsive adaptation, component behavior | | [spacing-principles.md](spacing-principles.md) | Spacing-specific principles — 4-point grid, proximity grouping, inner vs outer gaps, vertical and horizontal rhythm, heading→paragraph spacing, section and component spacing tiers | | [ux-principles.md](ux-principles.md) | Interaction & control principles — 30 UX laws, button/control state contracts (9 states), hover/active technique palettes, touch targets, cognitive load, feedback loops | | [typography-principles.md](typography-principles.md) | Typography-specific principles — type system foundations, scale & modular ratios, readability & measure, accessibility, responsive type, brand tone expression through type | | [accessibility.md](accessibility.md) | WCAG 2.1/2.2 compliance — contrast ratios, color-as-information rules, focus visibility, keyboard navigation, motion safety, target sizes, text spacing, semantic structure, ARIA | ## What these files are NOT These files do not define: - **Workflow phases** (think → build → check → ship) — see `skills/vertical/SKILL.md` - **Quality gates or audits** — see `skills/vertical/inspect.md`, `review.md`, `preflight.md` - **Anti-pattern catalogs** — see `skills/vertical/anti-patterns.md` - **Industry-specific content** — see `skills/vertical/team-social-saas.md` - **Design tokens or component specs** — see `skills/design-system/SKILL.md` ## Conflict resolution When sources disagree: 1. **Design system** wins for concrete values (colors, sizes, spacing tokens, component specs). 2. **Fundamentals** (this layer) win for structural principles (hierarchy, accessibility, motion logic). 3. **Vertical** wins for process decisions AND content architecture (section order, required sections, industry tone). Accessibility is non-negotiable at every level — it overrides aesthetic preferences everywhere. ## When the design system is silent, these principles decide Any design decision not covered by the system's tokens or component rules falls back to the principles here. Never contradict the design system — if a principle and a design-system rule conflict, the design system wins. Flag the conflict for review.
Excerpt, first 3,441 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 5dcf760
npx skills add https://github.com/bergside/typeui --skill typeui-fundamentals npm install claude plugin install typeui@bergside pip install .
git clone https://github.com/bergside/typeui git -C typeui checkout 5dcf760c4728
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 5dcf760c4728 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
| Windsurf | Mentioned in its text, not tested | Skills for Windsurf · About Windsurf |
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
5dcf760c4728
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/bergside/typeui-fundamentals/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All design & front-end skills →jackwener/opencli
基于 opencli 命令的智能搜索路由器。当用户想要使用 OpenCLI、CLI 或 API 搜索、查询、查找或研究信息时,尤其是涉及指定网站、社交媒体、技术资料、新闻、购物、旅游、求职、金融或中文内容时,务必使用此 skill
jackwener/opencli
Discover and invoke OpenCLI capabilities for websites and Chrome. Find commands, inspect schemas, interpret results and choose browser or adapter tools.
jackwener/opencli
Drive Chrome with OpenCLI to inspect pages, interact with logged-in sites, capture API evidence, and manage native tabs, groups and windows. For reusable adapters, see opencli-adapter-author.
jackwener/opencli
Automatically fix broken OpenCLI adapters when commands fail. Load this skill when an opencli command fails — it guides you through collecting a trace artifact, patching the adapter, retrying, and filing an upstream…
jackwener/opencli
Build or improve an OpenCLI JS adapter using observed site behavior, existing adapters and browser API evidence. For ad-hoc browser interaction, see opencli-browser.
dadbodgeoff/drift
Codebase intelligence for AI. Detects patterns & conventions + remembers decisions across sessions. MCP server for any IDE. Offline CLI.
Add this badge to your README
[](https://modelsatlas.com/skills/bergside/typeui-fundamentals/)
<a href="https://modelsatlas.com/skills/bergside/typeui-fundamentals/"><img src="https://modelsatlas.com/skills/bergside/typeui-fundamentals/badge.svg" alt="ModelsAtlas: BLOCK D"></a>
Questions about typeui-fundamentals
What does the typeui-fundamentals skill do?
Is typeui-fundamentals safe to install?
What can typeui-fundamentals access on my machine?
Which assistants does typeui-fundamentals work with?
How current is this page?
Sources
- github.com/bergside/typeui — the audited source at commit 5dcf760c4728 and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the typeui-fundamentals skill do?
- Is typeui-fundamentals safe to install?
- What can typeui-fundamentals access on my machine?