Waxell

skill

interactive-component-creator Review findings

qodex-aiqodex-ai/ai-agent-skillsupdated

Browse GitHub Download zipBook a demo
Build interactive web components and artifacts. Creates interactive UI elements, visualizations, and web-based applications.
qodex-ai's own description, from the skill's files.
Data & analyticsDesignResearchskill
Stars
47
Version
v1
Copies
0
OverviewSecurity7Versions1

Overview

holdReview findings

Waxell's checks found 7 findings to review, highest severity high.

Highest severity
high
Findings
7
What ran
Static analysis

A clean result means nothing alarming in what is published, not a guarantee. How the checks work

We don't republish the skill's instructions. Read them on GitHub at the reviewed commit.

Security

Security scan

Checked 2 days ago

Result

Review findings Waxell's checks found 7 findings to review, highest severity high.

Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work

Findings (7)

high · 7

  • high

    Tells Claude to install unpinned packages (parcel, @parcel/config-default, parcel-resolver-tspaths, html-inline)

    scripts/bundle-artifact.sh:21 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (pnpm)

    scripts/init-artifact.sh:36 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (tailwindcss@3.4.1, postcss, autoprefixer, @types/node, tailwindcss-animate)

    scripts/init-artifact.sh:78 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (class-variance-authority, clsx, tailwind-merge, lucide-react, next-themes)

    scripts/init-artifact.sh:79 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (@radix-ui/react-accordion, @radix-ui/react-aspect-ratio, @radix-ui/react-avatar, @radix-ui/react-checkbox, @radix-ui/react-collapsible, @radix-ui/react-context-menu …)

    scripts/init-artifact.sh:272 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (sonner, cmdk, vaul, embla-carousel-react, react-day-picker, react-resizable-panels …)

    scripts/init-artifact.sh:273 · skill_risk:S2

  • high

    scripts/shadcn-components.tar.gz: is a gzip archive inside the package

    scripts/shadcn-components.tar.gz · binary_risk:B4

Versions

Version history

Each distinct content we have seen, newest first, with the verdict it got at the time.

One version so far: v1, seen 2026-11-03.

See and control which skills your people use

Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

More data & analytics skills and plugins

See all