voidmatcha/ui-clone-skills

_AGENT_BROWSER_RE = re.compile(r"(?<![\w.-])(?:[^\s;&|]*/)?agent-browser(?:\s|$)")
_EVAL_RE = re.compile(r"(?<![\w.-])eval(?:\s|$)")
_DIRECT_READ_RE = re.compile(r"(?<![\w.-])(?:cat|sed|head|tail|nl|j...

_AGENT_BROWSER_RE = re.compile(r"(?<![\w.-])(?:[^\s;&|]*/)?agent-browser(?:\s|$)")
_EVAL_RE = re.compile(r"(?<![\w.-])eval(?:\s|$)")
_DIRECT_READ_RE = re.compile(r"(?<![\w.-])(?:cat|sed|head|tail|nl|j...

  grep -vE "^[^:]*:[0-9]+:[[:space:]]*#" | wc -l | tr -d ' ')
[ "$eval_count" -eq 0 ] && ok "no bash eval()" || err "bash eval() found ($eval_count occurrences)"

# CWE-377: insecure use of fixed temp...

    except json.JSONDecodeError as exc:
        print(f"inline-scripts: invalid JSON from agent-browser eval ({exc})", file=sys.stderr)
        return 3

    except json.JSONDecodeError as exc:
        print(f"inline-scripts: invalid JSON from agent-browser eval ({exc})", file=sys.stderr)
        return 3

# Agent post-push refresh hook: after a successful `git push`, wipe the local
# install at INSTALL_DIR and re-run the canonical curl-pipe install. This
# dogfoods install.sh end-to-end against the jus...

        try:
            proc = subprocess.run(["bash", str(resolver), str(REF_DIR)],
                                  capture_output=True, text=True, timeout=30)
        except Exception:

globalThis.document = { body: parent, querySelectorAll: () => [parent] };
const out = eval(fs.readFileSync(process.argv[2], 'utf8'));
console.log(out);
""",

    hover_css.write_text(json.dumps(HOVER_CSS), encoding="utf-8")
    proc = subprocess.run(
        ["bash", "-c", _function_source() + '\naffected_selector_for_hover "$1"', "_", activation],
       ...

    try:
        common = subprocess.run(
            ["git", "-C", str(ROOT), "rev-parse", "--git-common-dir"],
            capture_output=True, text=True, check=True, timeout=30,

// user input); evaluating it is the point of the harness.
const api = new Function(lib + '\nreturn { tfRefusal, tfPickOpener, tfOpenerWalk, tfOpenerClose, tfFingerprint, tfSettled };')();

const togg...

      return src.slice(0, src.indexOf(",")).includes(";base64")
        ? atob(payload)
        : decodeURIComponent(payload);
    }

PROBE_COUNT_RAW=$(agent-browser --session "$SESSION" eval '(() => {
  const SPEC_SELECTORS = JSON.parse(atob("'"$SPEC_SELECTORS_B64"'"));
  const hasScopedLegacy = Array.isArray(SPEC_SELECTORS) && SPE...

PHASE1="(async () => {
  const ENTRIES = JSON.parse(atob('$ENTRIES_B64'));
  $SNAP_JS
  // Mount sweep (Fix 78c) — React impls conditionally MOUNT animated content