Skip to content
Back to skills

017 Webapp Skill Analysis 81e73cb2

ASecurity

The webapp-building skill creates React applications with TypeScript, Vite, Tailwind CSS, and shadcn/ui. Unlike document skills (discrete files), this skill scaffolds **entire development environments** with build pipelines.

  • 9 stars
  • 0 votes
  • 0 copies
  • 4 views
  • Added October 11, 2026
developmentjavascripttypescriptpythonjavac#shellbashreactnodegit

Works with

  • cli

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 017-webapp-skill-analysis_81e73cb2 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 017 Webapp Skill Analysis 81e73cb2?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 017 Webapp Skill Analysis 81e73cb2
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-017-webapp-skill-analysis-81e73cb2/badge)](https://www.skillsdirectory.com/skills/tools-only-017-webapp-skill-analysis-81e73cb2)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
# WebApp Skill: Shell and IPython Integration Analysis

## Skill Overview
The webapp-building skill creates React applications with TypeScript, Vite, Tailwind CSS, and shadcn/ui. Unlike document skills (discrete files), this skill scaffolds **entire development environments** with build pipelines.

## Unique Characteristic
WebApp skill is **pure shell-driven** with minimal ipython usage compared to other skills. The workflow is:
1. Shell: Initialize project template
2. Shell: Install dependencies (npm)
3. Shell: Build production bundle
4. Shell: Deploy

IPython is used primarily for analysis and code generation, not direct file manipulation.

## Shell Usage Patterns

### 1. Project Initialization
```bash
bash /app/.kimi/skills/webapp-building/scripts/init-webapp.sh "Website Title"
```

**What This Does**:
```bash
# init-webapp.sh internals:
cd /mnt/okcomputer/output
mkdir -p app
cd app

# Copy template (73 files)
cp -r /app/.kimi/skills/webapp-building/scripts/template/* .

# Update title in index.html
sed -i "s/<title>.*</<title>Website Title</" index.html

# Install dependencies (npm)
npm install  # Installs 26,082 node_modules files

# Result: /mnt/okcomputer/output/app/ with full React project
```

**Template Contents** (73 files):
- React 18 + TypeScript 5 + Vite 5
- Tailwind CSS 3.4.19
- 50+ shadcn/ui components pre-installed
- Path aliases (@/) configured
- ESLint, PostCSS, TS configs

### 2. Development & Build
```bash
# Development (optional, usually not used)
cd /mnt/okcomputer/output/app && npm run dev

# Production build (REQUIRED)
cd /mnt/okcomputer/output/app && npm run build 2>&1
```

**Build Output**:
```
dist/
├── index.html          # Entry point (REQUIRED for deploy)
├── assets/
│   ├── index-[hash].js    # Bundled JavaScript
│   ├── index-[hash].css   # Bundled CSS
│   └── [images/fonts]
```

**Build Optimizations**:
- Tree-shaking (dead code elimination)
- Code splitting (lazy loading)
- Asset compression (gzip/brotli)
- Minification (Terser)
- Cache-busting hashes in filenames

### 3. Deployment
```bash
# Via tool (not shell directly)
mshtools-deploy_website(dist="/mnt/okcomputer/output/app/dist")
```

**Deployment Flow**:
1. Verify dist/index.html exists
2. Upload assets to CDN
3. Configure edge locations
4. Return public URL

### 4. File Operations (Shell)
```bash
# Read existing component
cat /mnt/okcomputer/output/app/src/components/ui/button.tsx

# List available components
ls /mnt/okcomputer/output/app/src/components/ui/
```

## IPython Usage Patterns

### 1. Code Generation (Primary IPython Role)
Unlike other skills where ipython modifies files directly, here ipython **generates code** that is then written via `write_file`:

```python
# Generate React component in ipython
component_code = '''
import * as React from "react"
import { Button } from "@/components/ui/button"
import { Card } from "@/components/ui/card"

export function HeroSection() {
  return (
    <Card className="p-6">
      <h1 className="text-2xl font-bold">Welcome</h1>
      <Button>Get Started</Button>
    </Card>
  )
}
'''

# Then write via write_file tool (not ipython file operations)
# write_file(file_path="/mnt/okcomputer/output/app/src/sections/Hero.tsx", 
#            content=component_code)
```

### 2. Dependency Analysis
```python
# Check package.json structure
import json

with open('/mnt/okcomputer/output/app/package.json') as f:
    pkg = json.load(f)

dependencies = pkg.get('dependencies', {})
print(f"React version: {dependencies.get('react')}")
print(f"Available UI components: {len(os.listdir('src/components/ui/'))}")
```

### 3. Build Output Analysis
```python
# Verify build succeeded
import os

dist_exists = os.path.exists('/mnt/okcomputer/output/app/dist/index.html')
assets = os.listdir('/mnt/okcomputer/output/app/dist/assets/') if dist_exists else []
print(f"Build valid: {dist_exists}, Assets: {len(assets)}")
```

## Tool Interaction Flow

### Complete Workflow
```
User: "Create a dashboard website"
    ↓
read_file(SKILL.md)              # Load workflow instructions
    ↓
shell: init-webapp.sh "Dashboard" # Initialize React project
    ↓
ipython: Analyze requirements    # Plan component structure
    ↓
ipython: Generate component code  # React + TypeScript code
    ↓
write_file: src/sections/*.tsx   # Write generated components
write_file: src/App.tsx          # Main application
    ↓
shell: npm run build             # Production bundle
    ↓
deploy_website: dist/            # Deploy to CDN
    ↓
Return public URL
```

### Component Modification Workflow
```
User: "Add dark mode toggle"
    ↓
read_file: src/App.tsx           # Current structure
    ↓
ipython: Generate toggle code    # State management, theme logic
    ↓
edit_file: src/App.tsx           # Add toggle component
write_file: src/hooks/use-theme.ts # New hook
    ↓
shell: npm run build             # Rebuild
    ↓
deploy_website: dist/            # Redeploy
```

## Architectural Significance

### 1. **Build System as Skill**
Unlike DOCX/XLSX/PDF which generate single files, WebApp skill manages:
- **26,082 node_modules files** (dependencies)
- **Build pipeline** (Vite bundler)
- **Development server** (optional)
- **Production optimization** (tree-shaking, etc.)

Shell commands manage the **build system**, not just individual binaries.

### 2. **IPython as Code Generator, Not File Manager**
In other skills, ipython directly manipulates files (openpyxl, lxml). In WebApp:
- IPython generates TypeScript/React code as **strings**
- `write_file` tool writes to disk
- Shell (`npm run build`) processes those files

This separation exists because:
- React build process requires Node.js toolchain (shell only)
- No native Python libraries for React bundling
- Vite/ESBuild are Node.js-native tools

### 3. **Template-Based Scaffolding**
The skill uses a **73-file template** rather than generating from scratch:
- Faster initialization (copy vs generate)
- Pre-configured best practices (ESLint, TSConfig)
- 50+ shadcn/ui components ready to use
- Git repository pre-initialized

### 4. **Stateless Build Process**
Each `npm run build` is **idempotent**:
- Clears dist/ directory
- Rebuilds from src/
- Deterministic output (same hash for same input)
- Enables confident redeployment

## Comparison with Other Skills

| Aspect | DOCX | XLSX | PDF | WebApp |
|--------|------|------|-----|--------|
| IPython Role | Code generation (C#) | Primary creation (openpyxl) | Source generation (HTML/LaTeX) | Code generation (TSX) |
| Shell Role | Compilation & validation | Validation binary | Rendering (Playwright/Tectonic) | Build system (npm/vite) |
| File Count | 1 output | 1 output | 1 output | 26,000+ files (including node_modules) |
| Iteration Speed | Slow (C# compile) | Fast (Python) | Medium (JS render) | Slow (npm install) |
| Direct Edit | IPython edits XML | IPython edits cells | IPython edits HTML/tex | write_file edits TSX |

## Critical Constraints

### Path Aliases
Template configures `@/` → `src/`:
```typescript
// Instead of: import Button from "../../../components/ui/button"
import { Button } from "@/components/ui/button"  // Preferred
```

### Build Requirements
- **Entry Point**: dist/index.html must exist
- **Client-Side Only**: No Node.js server runtime
- **Static Hosting**: All routes must work with static files

### Dependency Management
- **Pre-installed**: 50+ shadcn components
- **Adding New**: `npm install package` (requires shell)
- **Lock File**: package-lock.json tracks exact versions

## Paradigm Implications

The WebApp skill demonstrates **external build tool dependency**:
- Skill doesn't create content directly
- Skill sets up **development environment**
- Standard industry tools (npm, vite, react) do the work
- Agent generates **source code** that feeds into standard build pipeline

This is the most **conventional** skill architecture—it uses the same tools human developers use (npm, React, Vite), orchestrated by the agent via shell commands.

The skill's value is in:
1. **Template curation** (best practices pre-configured)
2. **Workflow guidance** (when to init, build, deploy)
3. **Component library** (50+ pre-installed UI components)
4. **Integration** (deploy tool connects to hosting)

Shell commands manage the **external toolchain**, ipython handles **code logic generation**, and the skill file provides **architectural guidance**.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.