JosiahSiegel/widgets-state-security-distribution
plugins/tui-master/skills/widgets-state-security-distribution/SKILL.md
This skill should be used when the user asks about TUI widgets, forms, dialogs, tables, trees, charts, command palettes, split panes, scrollbars, validation, state management, Elm/MVU architecture, async message passing, configuration, packaging, distribution, terminal security, escape-sequence injection, paste sanitization, or production hardening. PROACTIVELY activate for: widget design, validation, virtual scrolling, config/keybinding files, XDG paths, packaging, secure terminal output, and release readiness. Provides: widget contracts, state patterns, config, security, and distribution checklists.
$ install --global
skillsauthnpx skillsauth add JosiahSiegel/claude-plugin-marketplace widgets-state-security-distributionInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 26, 2026, 7:42 AM19.7s3 files scanned
SKILL.md
- name:
- widgets-state-security-distribution
- description:
- |
- This skill should be used when the user asks about TUI widgets, forms, dialogs, tables, trees, charts, command palettes, split panes, scrollbars, validation, state management, Elm/MVU architecture, async message passing, configuration, packaging, distribution, terminal security, escape-sequence injection, paste sanitization, or production hardening. PROACTIVELY activate for:
- widget design, validation, virtual scrolling, config/keybinding files, XDG paths, packaging, secure terminal output, and release readiness. Provides: widget contracts, state patterns, config, security, and distribution checklists.
Widgets, State, Configuration, Security, and Distribution
Use this skill when a TUI needs product-level interaction patterns, robust application state, secure terminal handling, user customization, or shipping guidance.
Widget design principles
- Every widget has state, focus rules, keyboard behavior, mouse behavior if supported, validation, accessibility fallback, and snapshot tests.
- Keep interactions predictable: lists navigate, tables sort/filter/page, forms validate near fields, dialogs trap focus, command palettes search commands, and scrollbars indicate position without being required.
- Virtualize large lists/tables/trees and keep viewport offset, selection, and expanded nodes in state.
- For charts, progress bars, spinners, and dashboards, provide textual summaries and reduced-motion/no-animation modes.
State and event architecture
Prefer an explicit model-update-view or reducer architecture:
- Model stores domain state and UI state.
- Events/messages represent keys, mouse, paste, resize, timers, worker results, and errors.
- Update transforms state and schedules side effects.
- View renders from state and dimensions.
- Effects run asynchronously and return messages.
This keeps rendering deterministic, makes tests cheap, and prevents background tasks from writing directly to the terminal.
Configuration and customization
- Use XDG base directories on Unix-like systems where appropriate; use platform-native config/cache/state locations on Windows and macOS.
- Allow keybinding remapping for advanced users and conflict-heavy environments such as tmux/Zellij.
- Store themes as semantic roles, not raw widget-specific colors.
- Validate config files strictly and show actionable errors in plain output if the TUI cannot start.
Terminal security
Terminal output is an interpreter. Sanitize untrusted text before writing it to a terminal or logs that may later be viewed in a terminal. Escape-sequence injection can change titles, write clipboard data, spoof prompts, hide text, or corrupt display state.
- Strip or visibly escape control characters from untrusted data unless intentionally rendering them.
- Treat pasted text as data, not commands.
- Bound paste length and validate after paste completes.
- Avoid automatic OSC 52 clipboard writes from untrusted content.
- Make hyperlinks visible and avoid misleading link text.
Distribution rules
- Document supported terminals and fallbacks.
- Ship a
--no-tuipath for automation, accessibility, and incident recovery. - Package with platform conventions: static binaries where feasible, Homebrew/Scoop/Winget/MSI/packages as appropriate, shell completions, manpages, and checksums.
- In containers, detect missing TTY and provide line-oriented behavior.
- Ensure crash cleanup works in release builds, not just development.
Reference files
references/widget-patterns.md- Common terminal widgets, behavior contracts, and anti-patterns.references/state-config-distribution-security.md- MVU state, async effects, config, packaging, and terminal security.
Related Skills
JosiahSiegel/ml-training
development
VerifiedTrustedCommunity
This skill should be used when the user asks to train, debug, scale, or improve ML models. PROACTIVELY activate for: (1) PyTorch, TensorFlow/Keras, JAX, Flax, Hugging Face Trainer/Accelerate training loops, (2) distributed training, DDP/FSDP/DeepSpeed, TPU/GPU setup, (3) mixed precision AMP/bf16, gradient accumulation, checkpointing, seeding, (4) overfitting, imbalance, loss functions, regularization, LR schedules, warmup, (5) memory optimization, gradient checkpointing, offloading, quantization-aware training. Provides: reproducible training best practices across deep learning and classical ML.
38SKILL.mdUpdated May 28, 2026
JosiahSiegel/ml-mlops
development
VerifiedTrustedCommunity
This skill should be used when the user asks to productionize, track, version, govern, monitor, or automate ML systems. PROACTIVELY activate for: (1) MLflow, Weights & Biases, Neptune, Comet, ClearML experiment tracking, (2) model registry, model versioning, artifact lineage, reproducibility, (3) Kubeflow, SageMaker Pipelines, Vertex AI Pipelines, Azure ML pipelines, Databricks workflows, (4) CI/CD, continuous training/evaluation, A/B tests, canary/shadow deployments, (5) drift detection, model monitoring, data validation, responsible AI governance. Provides: end-to-end MLOps architecture and operational safeguards.
38SKILL.mdUpdated May 28, 2026
JosiahSiegel/ml-inference-optimization
development
VerifiedTrustedCommunity
This skill should be used when the user asks to optimize, export, serve, compress, or accelerate ML inference. PROACTIVELY activate for: (1) latency, throughput, p95/p99, batching, concurrency, KV cache, memory, or cost issues, (2) quantization INT8/INT4, GPTQ, AWQ, bitsandbytes, pruning, sparsity, distillation, (3) ONNX export, ONNX Runtime, TensorRT, TorchScript, torch.compile, XLA, OpenVINO, Core ML, TFLite, (4) Triton, TorchServe, TF Serving, BentoML, Seldon, KServe configuration, (5) edge deployment, CPU/GPU/TPU/Inferentia serving. Provides: hardware-aware inference optimization and safe benchmarking.
38SKILL.mdUpdated May 28, 2026
JosiahSiegel/ml-hyperparameter-tuning
testing
VerifiedTrustedCommunity
This skill should be used when the user asks to tune hyperparameters, run sweeps, optimize search spaces, or use AutoML. PROACTIVELY activate for: (1) Optuna, Ray Tune, FLAML, AutoGluon, Hyperopt, Nevergrad, KerasTuner, W&B sweeps, (2) grid search, random search, Bayesian optimization, TPE, Gaussian processes, evolutionary search, (3) ASHA, Hyperband, successive halving, multi-fidelity optimization, population-based training, (4) learning-rate finder, batch-size search, early stopping, pruning, (5) reproducible sweep design and experiment analysis. Provides: budget-aware hyperparameter search strategy.
38SKILL.mdUpdated May 28, 2026