Agent skill · Audited from source
wiki-llms-txt
skill · bklit/bklit-uiMIT licenceAudited 24 Oct 2026 · source 260d476af4a4
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 260d476af4a4 and observed filesystem, network and shell access and no hard-coded secrets. The audit raised 17 findings, 2 critical or high. What it does: Turns plain-language chart design requests into exact Bklit UI (@bklit shadcn registry) components and props, styled to fit the host app. Use when someone describes how a chart should look rather than naming props, e.g.…
Cite
Cite this page
ModelsAtlas. “wiki-llms-txt (bklit/bklit-ui)”. Retrieved 24 Oct 2026. https://modelsatlas.com/skills/bklit/wiki-llms-txt
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Prompt injection” in .agents/skills/turborepo/SKILL.md:606. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 24 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.
What the source does
- FilesystemDeclared4 observations
- NetworkDeclared3 observations
- ShellDeclared5 observations
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 2 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 12 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 3 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: instruction override, no behavioural pass.
Findings (17)
HIGHPrompt injectionprompt.credential_read · .agents/skills/turborepo/SKILL.md:606
Turbo does NOT load `.env` files - your framework does. But Turbo needs to know about changes:
- Why
- asks the agent to read credentials
- Fix
- —
HIGHPrompt injectionprompt.hide_from_user · skills/bklit-ui/rules/animation.md:53
Don't tell the user the charts are fully reduced-motion safe.
- Why
- asks the agent to act without the user's knowledge
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .cursor/skills/turborepo
.cursor/skills/turborepo
- Why
- link not followed
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · apps/web/components/charts/line-chart-studio-trio-demo.tsx:19
"/studio?s=v1.NrAMBoCIBsEsDsCmBaAxgCwIYCcAukBdcYAJigHsBraDAClADoAOJkgAkYEYBmTt3kgwCcoAOwBKQsW4VqdRixIBSEqC68VoAcLHiAPlRrpanTaE0lOAVgaWr%2Bw-OZWzDMUM0AWJsKGSiwFbgnGKcAQBs4OHeASRCUKiYuAC2AK7Q0ABK5MlSwDx
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · apps/web/app/sitemap.ts:99
lastModified: gitLastModified(["app/studio", "../../packages/studio"]),
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · apps/web/app/studio/og-preview/layout.tsx:3
import "../../globals.css";
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · packages/studio/src/lib/__tests__/studio-component-tree-icon.test.ts:3
import { CHART_TYPE_ICONS } from "../../components/chart-type-icons";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · packages/ui/scripts/generate-block-registry.mjs:17
const webBlocksRoot = join(uiRoot, "../../apps/web/blocks");
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · packages/ui/scripts/generate-block-registry.mjs:165
"../../apps/web/components/docs/use-world-data.tsx"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.base64_blob · packages/studio/src/lib/__tests__/studio-url-codec.test.ts:20
"v1.NrAMBoCIBsEsDsCmBaAxgCwIYCcAukBdcYAJigHsBraDAClADoAOJkgAkYEYBmTt3kgwCcoAOwBKQsW4VqdRixIBSEqC68VoAcLHiAPlRrpanTaE0lOAVgaWr+w-OZWzDMUM0AWJsKGSiwFbgnGKcAQBs4OHeASRCUKiYuAC2AK7Q0ABK5MlSwJycZJAkeiUkeQU
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · apps/studio-docs/package.json
@base-ui/react, class-variance-authority, clsx, fumadocs-core, fumadocs-mdx, fumadocs-ui, geist, motion
- Why
- 20 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · apps/web/package.json
@base-ui/react, @number-flow/react, @openpanel/nextjs, @sparticuz/chromium-min, class-variance-authority, clsx, d3-shape, fumadocs-core
- Why
- 36 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · package.json
husky, prettier, turbo
- Why
- 3 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · packages/eslint-config/package.json
@eslint/js, @next/eslint-plugin-next, eslint, eslint-config-prettier, eslint-plugin-only-warn, eslint-plugin-react, eslint-plugin-react-hooks, eslint-plugin-turbo
- Why
- 11 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · packages/icons/package.json
@central-icons-react/all
- Why
- 1 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
INFOPrompt injectionprompt.credential_read · .agents/skills/turborepo/references/environment/gotchas.md:7
Turbo does NOT read `.env` files. Your framework (Next.js, Vite, etc.) or `dotenv` loads them. But Turbo needs to know when they change.
- Why
- asks the agent to read credentials
- Fix
- —
Audit 0.4.1 · source sha 260d476af4a4 · 24 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherbklit GitHub organizationOwner of the repository this skill is read from
- Source folderbklit/bklit-uiThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict260d476af4a4A new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Turns plain-language chart design requests into exact Bklit UI (@bklit shadcn registry) components and props, styled to fit the host app. Use when someone describes how a chart should look rather than naming props, e.g.…
---
name: bklit-ui-design
description: >
Turns plain-language chart design requests into exact Bklit UI (@bklit shadcn
registry) components and props, styled to fit the host app. Use when someone
describes how a chart should look rather than naming props, e.g. "diagonal
pattern background that fades out", "squircle bars", "3D glass bars", "hatched
area", "dot grid", "skeleton loading state", "dashed forecast", "half donut",
"make the charts match my brand / dark mode / border radius". Detects the
project's Tailwind version, colour format, dark-mode strategy, radius and
existing chart tokens, then picks a proven recipe, installs the right
@bklit/<item>, adapts colours to theme tokens and states honestly when Bklit
has no prop for the request. Also use when theming or restyling Bklit charts.
---
# Bklit UI design
Map what people *say* ("a hatched backdrop that fades at the edges") to what
Bklit *has* (`<Background />`), then make it look native to the app it lands in.
Bklit charts are installed as source with `npx shadcn@latest add @bklit/<item>`
(use the project's runner: `pnpm dlx`, `bunx --bun`, ...) and imported from the
project's alias, e.g. `@/components/charts/background`. Never import from
`@bklitui/ui/charts` — that is the private monorepo package.
## Workflow
### 1. Detect the host design
Run the bundled detector from the user's project root. `<skill-dir>` is the
folder containing this SKILL.md (commonly `.claude/skills/bklit-ui-design`,
`.agents/skills/bklit-ui-design` or `~/.claude/skills/bklit-ui-design`):
```bash
node <skill-dir>/scripts/detect-design.mjs
```
Zero dependencies, Node ≥ 18, never throws. It prints JSON: `tailwindVersion`,
`cssPath`, `colorFormat`, `darkMode`, `tokens` (`--primary`, `--radius`, ...),
`chartVars` (light/dark `--chart-*`), `themeInline`, `components` (from
`components.json`), `primitives`, `chartLibs`, `bklit.installed` and
`warnings`. Agents without shell access: read `components.json`, the global CSS
file it names, and `package.json`, and collect the same facts by hand.
Read `warnings` first — they flag the problems that make charts look broken
(gray default palette, Tailwind v3 bare-HSL tokens, missing `@theme` mappings).
### 2. Parse the request into design intents
Split the sentence into intents (background, fade, shape, fill, line, markers,
tooltip, grid, legend, loading, motion, annotation) and look each up in
[references/vocabulary.md](./references/vocabulary.md). Example:
> "squircle bars with a ghost track and a ring on hover"
> → shape: `BarSquares squareRadius={0.5}` + `BarChart squareSnap` ·
> track: `BarColumnTrack` · tooltip: `ChartTooltip dotVariant="ring" dotRadiusFraction={0.5}`
> "diagonal pattern background that fades out on all sides"
> → `<Background />` (diagonal and 4-side fade are the defaults)
### 3. Pick a recipe and adapt it
Start from the closest composition in [references/recipes.md](./references/recipes.md)
rather than assembling from scratch — those are the gallery's proven looks.
Then adapt to the detection output:
- colours → `var(--chart-1..5)` / `chartCssVars`, never literals;
- corner style → host `--radius` (rules/taste.md §4);
- density → fewer grid rows / no background in small dashboard cards;
- palette, dark mode, Tailwind v3 quirks → [rules/theming.md](./rules/theming.md).
### 4. Install the registry items
Install every item the composition touches (the vocabulary's import table lists
which slug provides each export), e.g.:
```bash
npx shadcn@latest add @bklit/bar-chart @bklit/bar-depth @bklit/chart-tooltip
```
shadcn adds missing CSS variables without overwriting the host's existing ones.
If `@bklit` does not resolve, see the `bklit-ui` skill's installation notes.
### 5. Confirm props against the installed source
Open the installed files (`components/charts/<file>.tsx`) and check every prop
you plan to use exists with the expected type. The registry source is the
contract; this skill can lag behind it.
### 6. Apply the taste rules
Run through [rules/taste.md](./rules/taste.md): one decorative layer, subtle
backgrounds, no stacked effects, corners matching `--radius`, rings with
squares, tokens only, dark mode verified, unique pattern ids.
### 7. Be honest about gaps
If the request needs something Bklit lacks (see "Not supported" in the
vocabulary — e.g. hexagon `Background` preset, glow on lines, stacked areas,
labels on bars), say so plainly, then offer the nearest supported look or a
small custom composition (recipe 15 shows the pattern). Never invent props such
as `pattern="hexagons"` or `glow`.
## Output checklist
- Install command(s) with the exact `@bklit/<item>` slugs.
- Complete JSX with imports from the project alias.
- Any CSS token changes, in the host's colour format, for light **and** dark.
- One line per honest gap or trade-off.
- Links when useful: `https://bklit.com/docs/components/<slug>`,
`https://bklit.com/charts/<slug>`, `https://bklit.com/studio?chart=<slug>`.
## Files
| File | Use |
|---|---|
| [references/vocabulary.md](./references/vocabulary.md) | Phrase → JSX/props → registry slug; import map; unsupported list |
| [references/recipes.md](./references/recipes.md) | 15 complete compositions for named looks |
| [rules/taste.md](./rules/taste.md) | Design rules with incorrect/correct pairs |
| [rules/theming.md](./rules/theming.md) | Host signals → chart token overrides (v4, v3, dark mode) |
| [scripts/detect-design.mjs](./scripts/detect-design.mjs) | Design detection (JSON) |
| [evals/evals.json](./evals/evals.json) | Behaviour checks for this skill |Excerpt, first 5,613 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 260d476
npm install lodash --workspace=@repo/utils npm install jest --save-dev --workspace=web --workspace=@repo/ui npm install typescript@latest --workspaces npx skills add bklit/bklit-ui npx skills add bklit/bklit-ui --skill bklit-ui
git clone https://github.com/bklit/bklit-ui git -C bklit-ui checkout 260d476af4a4
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 260d476af4a4 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
260d476af4a4
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/bklit/wiki-llms-txt/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All coding & review skills →bklit/bklit-ui
Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages,…
bklit/bklit-ui
Guardrails for adding unit tests in bklit-ui without over-testing. Use when the user mentions unit test, unit tests, tests, test coverage, add tests, write tests, vitest, jest, or asks whether something should be tested.
bklit/bklit-ui
bklit-ui monorepo contributors only — ship a chart or component from Studio prototype to production in packages/ui with docs and registry.
bklit/bklit-ui
Install, compose, theme, and animate Bklit UI charts (the @bklit shadcn registry) in a React / Next.js app. Use when the user wants a chart, graph, or data visualization: line, area, bar, live/streaming line, composed,…
facebook/react
Use when you want to validate changes before committing, or when you need to check all React contribution requirements.
facebook/react
Use when you need to run tests for React core. Supports source, www, stable, and experimental channels.
Add this badge to your README
[](https://modelsatlas.com/skills/bklit/wiki-llms-txt/)
<a href="https://modelsatlas.com/skills/bklit/wiki-llms-txt/"><img src="https://modelsatlas.com/skills/bklit/wiki-llms-txt/badge.svg" alt="ModelsAtlas: BLOCK D"></a>
Questions about wiki-llms-txt
What does the wiki-llms-txt skill do?
Is wiki-llms-txt safe to install?
What can wiki-llms-txt access on my machine?
Which assistants does wiki-llms-txt work with?
How current is this page?
Sources
- github.com/bklit/bklit-ui — the audited source at commit 260d476af4a4 and every finding aboveObserved · 24 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the wiki-llms-txt skill do?
- Is wiki-llms-txt safe to install?
- What can wiki-llms-txt access on my machine?