Agent skill · Audited from source

wiki-llms-txt

skill · bklit/bklit-uiMIT licenceAudited 24 Oct 2026 · source 260d476af4a4

★ 1,807pushed todayversion 1.0.0
✕BLOCKGrade D · 69/100 · 17 findings · 260d476
1,807repo stars · whole bklit/bklit-ui

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 260d476af4a4 and observed filesystem, network and shell access and no hard-coded secrets. The audit raised 17 findings, 2 critical or high. What it does: Turns plain-language chart design requests into exact Bklit UI (@bklit shadcn registry) components and props, styled to fit the host app. Use when someone describes how a chart should look rather than naming props, e.g.…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “wiki-llms-txt (bklit/bklit-ui)”. Retrieved 24 Oct 2026. https://modelsatlas.com/skills/bklit/wiki-llms-txt

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Prompt injection” in .agents/skills/turborepo/SKILL.md:606. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 24 Oct 2026

Trust score69/100✕BLOCK D
0 critical2 high2 medium12 low1 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemDeclared4 observations
  • NetworkDeclared3 observations
  • ShellDeclared5 observations
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN2
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN12
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL3
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: instruction override, no behavioural pass.

Findings (17)

HIGHPrompt injectionprompt.credential_read · .agents/skills/turborepo/SKILL.md:606
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Turbo does NOT load `.env` files - your framework does. But Turbo needs to know about changes:
Why
asks the agent to read credentials
Fix
—
HIGHPrompt injectionprompt.hide_from_user · skills/bklit-ui/rules/animation.md:53
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Don't tell the user the charts are fully reduced-motion safe.
Why
asks the agent to act without the user's knowledge
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · apps/web/components/charts/line-chart-studio-trio-demo.tsx:19
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"/studio?s=v1.NrAMBoCIBsEsDsCmBaAxgCwIYCcAukBdcYAJigHsBraDAClADoAOJkgAkYEYBmTt3kgwCcoAOwBKQsW4VqdRixIBSEqC68VoAcLHiAPlRrpanTaE0lOAVgaWr%2Bw-OZWzDMUM0AWJsKGSiwFbgnGKcAQBs4OHeASRCUKiYuAC2AK7Q0ABK5MlSwDx
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .biomeignore
F-13 Inventory / provenanceCWE-1104Layer L0
.biomeignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWFilesystem / pathfs.traversal · apps/web/app/sitemap.ts:99
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
lastModified: gitLastModified(["app/studio", "../../packages/studio"]),
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · apps/web/app/studio/og-preview/layout.tsx:3
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import "../../globals.css";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/studio/src/lib/__tests__/studio-component-tree-icon.test.ts:3
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { CHART_TYPE_ICONS } from "../../components/chart-type-icons";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/ui/scripts/generate-block-registry.mjs:17
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const webBlocksRoot = join(uiRoot, "../../apps/web/blocks");
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/ui/scripts/generate-block-registry.mjs:165
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"../../apps/web/components/docs/use-world-data.tsx"
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · packages/studio/src/lib/__tests__/studio-url-codec.test.ts:20
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"v1.NrAMBoCIBsEsDsCmBaAxgCwIYCcAukBdcYAJigHsBraDAClADoAOJkgAkYEYBmTt3kgwCcoAOwBKQsW4VqdRixIBSEqC68VoAcLHiAPlRrpanTaE0lOAVgaWr+w-OZWzDMUM0AWJsKGSiwFbgnGKcAQBs4OHeASRCUKiYuAC2AK7Q0ABK5MlSwJycZJAkeiUkeQU
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · apps/studio-docs/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@base-ui/react, class-variance-authority, clsx, fumadocs-core, fumadocs-mdx, fumadocs-ui, geist, motion
Why
20 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · apps/web/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@base-ui/react, @number-flow/react, @openpanel/nextjs, @sparticuz/chromium-min, class-variance-authority, clsx, d3-shape, fumadocs-core
Why
36 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
husky, prettier, turbo
Why
3 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · packages/eslint-config/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@eslint/js, @next/eslint-plugin-next, eslint, eslint-config-prettier, eslint-plugin-only-warn, eslint-plugin-react, eslint-plugin-react-hooks, eslint-plugin-turbo
Why
11 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · packages/icons/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@central-icons-react/all
Why
1 dependency range(s) float
Fix
pin exact versions or ship a lockfile
INFOPrompt injectionprompt.credential_read · .agents/skills/turborepo/references/environment/gotchas.md:7
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Turbo does NOT read `.env` files. Your framework (Next.js, Vite, etc.) or `dotenv` loads them. But Turbo needs to know when they change.
Why
asks the agent to read credentials
Fix
—

Audit 0.4.1 · source sha 260d476af4a4 · 24 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherbklit GitHub organizationOwner of the repository this skill is read from
  • Source folderbklit/bklit-uiThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict260d476af4a4A new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Turns plain-language chart design requests into exact Bklit UI (@bklit shadcn registry) components and props, styled to fit the host app. Use when someone describes how a chart should look rather than naming props, e.g.…

---
name: bklit-ui-design
description: >
  Turns plain-language chart design requests into exact Bklit UI (@bklit shadcn
  registry) components and props, styled to fit the host app. Use when someone
  describes how a chart should look rather than naming props, e.g. "diagonal
  pattern background that fades out", "squircle bars", "3D glass bars", "hatched
  area", "dot grid", "skeleton loading state", "dashed forecast", "half donut",
  "make the charts match my brand / dark mode / border radius". Detects the
  project's Tailwind version, colour format, dark-mode strategy, radius and
  existing chart tokens, then picks a proven recipe, installs the right
  @bklit/<item>, adapts colours to theme tokens and states honestly when Bklit
  has no prop for the request. Also use when theming or restyling Bklit charts.
---

# Bklit UI design

Map what people *say* ("a hatched backdrop that fades at the edges") to what
Bklit *has* (`<Background />`), then make it look native to the app it lands in.

Bklit charts are installed as source with `npx shadcn@latest add @bklit/<item>`
(use the project's runner: `pnpm dlx`, `bunx --bun`, ...) and imported from the
project's alias, e.g. `@/components/charts/background`. Never import from
`@bklitui/ui/charts` — that is the private monorepo package.

## Workflow

### 1. Detect the host design

Run the bundled detector from the user's project root. `<skill-dir>` is the
folder containing this SKILL.md (commonly `.claude/skills/bklit-ui-design`,
`.agents/skills/bklit-ui-design` or `~/.claude/skills/bklit-ui-design`):

```bash
node <skill-dir>/scripts/detect-design.mjs
```

Zero dependencies, Node ≥ 18, never throws. It prints JSON: `tailwindVersion`,
`cssPath`, `colorFormat`, `darkMode`, `tokens` (`--primary`, `--radius`, ...),
`chartVars` (light/dark `--chart-*`), `themeInline`, `components` (from
`components.json`), `primitives`, `chartLibs`, `bklit.installed` and
`warnings`. Agents without shell access: read `components.json`, the global CSS
file it names, and `package.json`, and collect the same facts by hand.

Read `warnings` first — they flag the problems that make charts look broken
(gray default palette, Tailwind v3 bare-HSL tokens, missing `@theme` mappings).

### 2. Parse the request into design intents

Split the sentence into intents (background, fade, shape, fill, line, markers,
tooltip, grid, legend, loading, motion, annotation) and look each up in
[references/vocabulary.md](./references/vocabulary.md). Example:

> "squircle bars with a ghost track and a ring on hover"
> → shape: `BarSquares squareRadius={0.5}` + `BarChart squareSnap` ·
> track: `BarColumnTrack` · tooltip: `ChartTooltip dotVariant="ring" dotRadiusFraction={0.5}`

> "diagonal pattern background that fades out on all sides"
> → `<Background />` (diagonal and 4-side fade are the defaults)

### 3. Pick a recipe and adapt it

Start from the closest composition in [references/recipes.md](./references/recipes.md)
rather than assembling from scratch — those are the gallery's proven looks.
Then adapt to the detection output:

- colours → `var(--chart-1..5)` / `chartCssVars`, never literals;
- corner style → host `--radius` (rules/taste.md §4);
- density → fewer grid rows / no background in small dashboard cards;
- palette, dark mode, Tailwind v3 quirks → [rules/theming.md](./rules/theming.md).

### 4. Install the registry items

Install every item the composition touches (the vocabulary's import table lists
which slug provides each export), e.g.:

```bash
npx shadcn@latest add @bklit/bar-chart @bklit/bar-depth @bklit/chart-tooltip
```

shadcn adds missing CSS variables without overwriting the host's existing ones.
If `@bklit` does not resolve, see the `bklit-ui` skill's installation notes.

### 5. Confirm props against the installed source

Open the installed files (`components/charts/<file>.tsx`) and check every prop
you plan to use exists with the expected type. The registry source is the
contract; this skill can lag behind it.

### 6. Apply the taste rules

Run through [rules/taste.md](./rules/taste.md): one decorative layer, subtle
backgrounds, no stacked effects, corners matching `--radius`, rings with
squares, tokens only, dark mode verified, unique pattern ids.

### 7. Be honest about gaps

If the request needs something Bklit lacks (see "Not supported" in the
vocabulary — e.g. hexagon `Background` preset, glow on lines, stacked areas,
labels on bars), say so plainly, then offer the nearest supported look or a
small custom composition (recipe 15 shows the pattern). Never invent props such
as `pattern="hexagons"` or `glow`.

## Output checklist

- Install command(s) with the exact `@bklit/<item>` slugs.
- Complete JSX with imports from the project alias.
- Any CSS token changes, in the host's colour format, for light **and** dark.
- One line per honest gap or trade-off.
- Links when useful: `https://bklit.com/docs/components/<slug>`,
  `https://bklit.com/charts/<slug>`, `https://bklit.com/studio?chart=<slug>`.

## Files

| File | Use |
|---|---|
| [references/vocabulary.md](./references/vocabulary.md) | Phrase → JSX/props → registry slug; import map; unsupported list |
| [references/recipes.md](./references/recipes.md) | 15 complete compositions for named looks |
| [rules/taste.md](./rules/taste.md) | Design rules with incorrect/correct pairs |
| [rules/theming.md](./rules/theming.md) | Host signals → chart token overrides (v4, v3, dark mode) |
| [scripts/detect-design.mjs](./scripts/detect-design.mjs) | Design detection (JSON) |
| [evals/evals.json](./evals/evals.json) | Behaviour checks for this skill |

Excerpt, first 5,613 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 260d476

npm install lodash --workspace=@repo/utils
npm install jest --save-dev --workspace=web --workspace=@repo/ui
npm install typescript@latest --workspaces
npx skills add bklit/bklit-ui
npx skills add bklit/bklit-ui --skill bklit-ui

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 260d476af4a4 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 260d476af4a4

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/bklit/wiki-llms-txt/badge.svg)](https://modelsatlas.com/skills/bklit/wiki-llms-txt/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/bklit/wiki-llms-txt/badge.svg)](https://modelsatlas.com/skills/bklit/wiki-llms-txt/)

Questions about wiki-llms-txt

What does the wiki-llms-txt skill do?
Open-source UI & Charts library
Is wiki-llms-txt safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can wiki-llms-txt access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does wiki-llms-txt work with?
Its documentation mentions claude-code, codex and cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (260d476af4a4), read on 2026-10-24. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.