Atlas / Skills / htmlstreamofficial / Preline Theme Generator

Preline Theme GeneratorBLOCK

skills/htmlstreamofficial/preline-theme-generator

Preline UI is an open-source set of prebuilt UI components based on the utility-first Tailwind CSS framework.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
3 documented
License
NOASSERTION
Stars
6,494
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://preline.co)

Preline UI is an open-source Tailwind CSS UI component library for building modern websites and apps. It includes UI blocks, templates, plugins, a Figma design system, and more.

[](https://opensource.org/licenses/MIT)

✨ About Preline

Preline helps teams build modern websites and web apps faster with reusable Tailwind CSS components, interactive headless Tailwind CSS plugins, Tailwind CSS templates, and production-ready Tailwind CSS examples. It is designed for developers who want flexible markup, scalable design systems, and polished UI patterns without rebuilding everything from scratch.

⚡ Getting Started

Start with any working Tailwind CSS project and make sure Node.js and npm are installed.

Install via npm

  1. Install preline:
npm i preline
  1. Import the Preline CSS variants file into your Tailwind CSS file after the tailwindcss import:
@import "tailwindcss";

/* Preline UI */
@source "./node_modules/preline/dist/*.js";
@import "./node_modules/preline/variants.css";

/* Preline Themes */
@import "./themes/theme.css";
  1. Add the Preline JavaScript file near th
Read from source at commit 8bb1403f0140OBSERVED · 2026-10-20
Advertisement
02

Install

Commands as the repository documents them. They are shown, not run.

npm i preline
npx skills add htmlstreamofficial/preline
npm i @preline/accordion
npm i @preline/carousel
npm i @preline/collapse
npm i @preline/combobox
03

Host compatibility

What the documentation claims. We have not run a compatibility test.

HostStatusNotes
claude-codementioned
cursormentioned
gemini-climentioned
04

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: preline-mcp
description: Add, integrate, or build Preline UI components and blocks into HTML files via the Preline MCP server. Use when the user mentions "preline", says "/preline", asks to add a UI component, or requests a Preline block (a ready-made page section) using Preline UI.
---

# Preline MCP

## Intent

Use this skill to integrate Preline UI components and blocks into HTML files via the Preline MCP server. The server exposes 6 tools that return integration-ready HTML, CSS, and JS.

Activate when:
- User says "preline", "add preline", "/preline", "use preline"
- User asks for a Tailwind CSS component from the Preline library
- User asks for a block (ready-made page section) or a starter page

## Defaults

- **Never guess slugs.** All section, component, and category identifiers are exact kebab-case strings. Always discover them via `components_list` or `blocks_categories` first.
- **One at a time.** Retrieve one component or block, integrate it fully, then move to the next.
- **Always read the target file** before inserting anything.
- Call `components_list({ section: "<inferred-slug>" })` when the component type is known - this keeps the response small. Omit section only when unsure.

## Decision: Component vs Block

| User says | Use |
|---|---|
| "component" / "components" | Component workflow |
| "block" / "blocks" (or "example" / "examples") | Block workflow |
| Ambiguous | Use judgment; blocks give more complete results |

## Clarifying Vague Requests

Ask the user to pick instead of guessing in either of these cases:

- **Abstract request.** Too abstract to confidently map onto one category/section, let alone one block/component - e.g. "give me something for a pricing page", "I need a nice form", "show me a dashboard example". Start at step 1 below.
- **Tied candidates.** The request is concrete enough to reach a single category/section, but `blocks_in_category` / `components_list({ section })` still leaves 2+ candidates whose titles + descriptions satisfy every criterion the request named about equally well (same layout/feature/style class), with nothing in the request to break the tie. Skip straight to step 3 below with just the tied candidates.

If exactly one candidate matches everything the request names ("a basic accordion", "the SaaS hero with tabs"), skip straight to the normal workflow - don't interrogate the user for things you can already resolve, and don't ask just to be safe when one option is clearly the best fit.

All clarifying questions and lists are in **English by default** - switch to the user's language only once they write to you in it.

**Blocks:**
1. **Ask which category fits.** Call `blocks_categories()` and present the relevant `mainSection / subSection / category` paths with their titles and descriptions - the catalog carries a one-line description for every category, so present it directly rather than inventing your own summary.
2. **Try to resolve in one round.** If the user's reply both names a category *and* describes the item distinctively enough to identify a single match (a specific layout, feature, or style), call `blocks_in_category` to confirm the exact ID and go straight to `single_block` - skip step 3 entirely.
3. **Otherwise, ask which block fits best.** Call `blocks_in_category({ mainSection, subSection, category })`, list the block titles + descriptions - or just the tied candidates, for the case above - and ask the user to pick the one closest to their needs.
4. **Fetch and integrate** the chosen block with `single_block`.

**Components - same shape, sections instead of categories:**
1. Ask which **section** fits (`components_list()` for the full list, or `components_list({ section })` once you can infer one).
2. If the reply names a section *and* describes the component distinctively enough → resolve directly via `single_component` (lean on `relative` metadata - see Smart Component Selection - to land on the right default/variant).
3. Otherwise list the components in that section (titles + descriptions, with `relative.category` groupings where present - or just the tied candidates, for the case above) and ask which fits best.
4. Fetch and integrate with `single_component`.

Keep each round to one focused question with a short, scannable list - that beats an open "what do you want?" and beats guessing a slug just to avoid asking.

## Composite & Layout Requests

When a request describes **more than a single component** - several pieces, a region, a full page, or an app shell - don't fetch ad-hoc. Plan the whole result first, then fetch and integrate one node at a time. The same steps apply to any shape: a dashboard, a settings page, a product page, a multi-step form, "a card/section/layout with X, Y and Z", etc.

1. **Lock cross-cutting constraints first.** Anything that applies to the whole result - class system (theme tokens vs utilities → `isUtilityBased` / `theme`), shared surfaces/colors, spacing/density, repeated element states - decide once, up front. Keep it identical across every later fetch and edit.
2. **Decompose into a tree:** containers → regions → leaf components. Write it down; each leaf is one fetch.
3. **Discover every node - route, then confirm.** Use [references/catalog-map.md](references/catalog-map.md) to route: an abstract intent (a whole page/region/shell) → the right `blocks_categories` branch (reuse a ready-made block as the skeleton when one fits); each named element → the right `components_list({ section })`. The map only tells you *where to look* - always confirm the exact slug against the tool output before inserting.
4. **Assemble outermost-first, one at a time.** The skeleton/outer container sets the shared surfaces and the script/init anchors; then fill inward region by region, integrating each fully (Integration Rules) before the next. Keep the returned classes, change **text only** - except the specific surfaces/colors/states the user asked to change. Apply every structural adaptation 
05

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (8 observation(s))
Network
declared (3 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (19)

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427
skills/theme-generator/SKILL.md:8
Use the bundled local scripts. Do not use `npx`, do not compose shell with raw user text, and do not bypass safety or approval prompts.
Why it matters. asks the agent to drop prior instructions or safety
Fix. remove the instruction
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
dist/datepicker-non-auto.js:30
!function(e){"use strict";var t=Object.defineProperty,n=Object.defineProperties,o=Object.getOwnPropertyDescriptors,s=Object.getOwnPropertySymbols,i=Object.prototype.hasOwnProperty,a=Object.prototype.p
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
dist/datepicker.js:30
!function(e){"use strict";var t=Object.defineProperty,n=Object.defineProperties,o=Object.getOwnPropertyDescriptors,s=Object.getOwnPropertySymbols,i=Object.prototype.hasOwnProperty,a=Object.prototype.p
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
dist/datepicker.mjs:9
class o{constructor(e,t,n){this.el=e,this.options=t,this.events=n,this.el=e,this.options=t,this.events={}}createCollection(e,t){var n,o;let i=e;if(!Array.isArray(i)&&"undefined"!=typeof window){const
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
dist/index.js:206
!function(e){"use strict";var t=Object.defineProperty,i=Object.defineProperties,s=Object.getOwnPropertyDescriptors,n=Object.getOwnPropertySymbols,o=Object.prototype.hasOwnProperty,l=Object.prototype.p
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
dist/non-auto.js:212
!function(e){"use strict";var t=Object.defineProperty,i=Object.defineProperties,s=Object.getOwnPropertyDescriptors,n=Object.getOwnPropertySymbols,o=Object.prototype.hasOwnProperty,l=Object.prototype.p
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
src/plugins/combobox/README.md:108
<div class="absolute z-50" style="display: none;" data-hs-combo-box-output>
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
src/plugins/combobox/README.md:129
- Add `style="display: none;"` to the output container initially
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
src/plugins/datatable/README.md:157
<div style="display: none;" data-hs-datatable-paging>
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
src/plugins/stepper/README.md:123
}' style="display: none;">
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
src/plugins/stepper/README.md:128
}' style="display: none;">
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/plugins/accessibility-manager/index.ts:5
import { isFormElement } from '../../utils';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/plugins/accordion/core.ts:14
} from '../../utils';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/plugins/accordion/core.ts:24
import { ICollectionItem } from '../../interfaces';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/plugins/carousel/core.ts:9
import { classToClassList, debounce, htmlToElement } from '../../utils';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/plugins/carousel/core.ts:15
import { BREAKPOINTS } from '../../constants';
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@floating-ui/dom, @types/culori, apexcharts, culori, datatables.net, datatables.net-dt, dropzone, nouislider
Why it matters. 19 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:74
| Forms | [Select](https://preline.co/plugins/advanced-select.html), [ComboBox](https://preline.co/plugins/combobox.html), [Datepicker](https://preline.co/plugins/advanced-datepicker.html), [Range Sli
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:90
| Third-Party Plugins | [Advanced Range Slider](https://preline.co/docs/components/advanced-range-slider.html), [Advanced Datepicker](https://preline.co/docs/components/advanced-datepicker.html), [Cha
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-20 · audit v0.4.1 · source sha 8bb1403f0140full audit observations/trust-audit/skill/htmlstreamofficial__preline-theme-generator.json · Report an issue / request a re-scan
06

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-208bb1403f0140BLOCKD69first audit
07

Questions

What does the preline-theme-generator — htmlstreamofficial/preline skill do?

Preline UI is an open-source set of prebuilt UI components based on the utility-first Tailwind CSS framework.

Is preline-theme-generator — htmlstreamofficial/preline safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can preline-theme-generator — htmlstreamofficial/preline access on my machine?

The audit observed that it reaches the network and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.

Which assistants does preline-theme-generator — htmlstreamofficial/preline work with?

Its documentation mentions claude-code, cursor and gemini-cli. That is what the text claims, not a compatibility test we ran.

How current is this page?

The grade is for one exact copy of the source (8bb1403f0140), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Add this badge to your README

Shows this page's audit result and links back to it. It updates when the audit does.

ModelsAtlas audit badge

Markdown
[![ModelsAtlas audit: Preline Theme Generator](https://modelsatlas.com/skills/htmlstreamofficial/preline-theme-generator/badge.svg)](https://modelsatlas.com/skills/htmlstreamofficial/preline-theme-generator/)

Not your listing, or something out of date? Claim or update your listing.

Advertisement