bjornmelin/web-rive
plugins/web-motion/skills/web-rive/SKILL.md
Use this skill for Rive web and React runtime integration, .riv assets, state machines, inputs, lifecycle cleanup, accessibility, remote asset security, and fallback behavior. Trigger on Rive, .riv, state machine input, @rive-app/react-webgl2, @rive-app/webgl2, @rive-app/react-canvas, @rive-app/canvas, Rive web. Do not use for near-miss tasks outside these boundaries; route to adjacent motion or platform skills when they own the implementation.
$ install --global
skillsauthnpx skillsauth add bjornmelin/dev-skills web-riveInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 11, 2026, 3:42 AM117.6s20 files scanned
SKILL.md
- name:
- web-rive
- description:
- >-
- license:
- MIT
Web Rive
Rive web and React runtime integration, .riv assets, state machines, inputs, lifecycle cleanup, accessibility, remote asset security, and fallback behavior.
Operating Contract
Use this skill as a compact router plus domain checklist. Load references only when the current task matches their condition. Do not cite local scrape paths, machine cache paths, or hidden source locations. Verify API details against the target repo's installed package versions before editing.
Source Order
- Inspect the target repo's installed packages, framework/runtime versions, local design tokens, accessibility policy, and existing motion patterns.
- Use the bundled references below for skill-specific gotchas and copied source excerpts.
- Use official current docs/package source as API truth when local code or bundled notes are version-sensitive.
Decision Boundaries
- Use web-lottie for Lottie/dotLottie assets.
- Use native-rive for React Native.
- Use Motion/GSAP/CSS when no .riv asset or state machine is involved.
Workflow
- Inspect asset ownership, state machine names, inputs, autoplay, and runtime package.
- Bind inputs through stable component state and cleanup runtime instances.
- Add fallback and accessible semantics outside canvas.
- Review URL actions and remote asset policy.
Gotchas
- Canvas output is not self-describing to assistive tech.
- State machine input names are asset contracts; verify against the asset.
- Remote .riv files and URL actions need explicit allowlisting.
Bundled Resources
references/rive-react-runtime.md- Rive React/runtime lifecycle. Read when using @rive-app/react-webgl2, @rive-app/webgl2, @rive-app/react-canvas, or @rive-app/canvas.references/state-machine-inputs.md- State machine input contract guide. Read when setting boolean, number, or trigger inputs.references/asset-security-and-fallbacks.md- Rive asset security, accessibility, and fallback review. Read before shipping remote assets, URL actions, or canvas-only states.references/layout-fit-and-resize.md- Rive layout, fit, resize, and DPR behavior. Read when sizing a Rive canvas/component, changing artboards, or debugging cropped/blurred assets.references/data-binding-and-events.md- Rive data binding and event contracts. Read when Rive state machines, inputs, events, or data binding connect to app state.references/docs-rive-react.md- Copied source excerpt. Load only when exact upstream wording or API detail is needed.references/docs-rive-state-machine.md- Copied source excerpt. Load only when exact upstream wording or API detail is needed.references/docs-rive-web-js.md- Copied source excerpt. Load only when exact upstream wording or API detail is needed.references/implementation-notes.md- Copied source excerpt. Load only when exact upstream wording or API detail is needed.references/index.md- Complete reference inventory and routing summary.references/source-ledger.md- Source list, checked date, and copy policy.references/provenance.json- Machine-readable source and local-resource metadata.scripts/audit.mjs- Self-contained audit CLI; rundoctorbeforescanwhen setup is unclear.assets/templates/web-rive-audit-report.md- Audit response/report template.assets/templates/web-rive-review-checklist.md- Manual review checklist.assets/examples/web-rive-starter.tsx- Starter fixture/example for this skill.evals/trigger-queries.json- Trigger/near-miss eval set for description tuning.evals/evals.json- Task-quality evals with assertions.
Audit CLI
node scripts/audit.mjs doctor --root . --format json
node scripts/audit.mjs scan --root . --format markdown
node scripts/audit.mjs scan --root . --format json --output web-rive-audit.json
Treat script findings as leads. Verify every finding against current code before changing behavior or reporting it as valid.
Closeout
Before finalizing, run the repo's focused validation command, this skill's audit CLI when relevant, and any browser/device/manual proof required by the changed surface. Report commands run, findings fixed, findings skipped with reasons, and residual risk.
Related Skills
bjornmelin/repo-modernizer
development
VerifiedTrustedCommunity
Repo/monorepo modernization: dependency upgrades, security fixes, deprecation cleanup, framework migrations, dependency-native refactors, and verified hard-cut simplification.
2SKILL.mdUpdated Jun 11, 2026
bjornmelin/web-waapi
development
VerifiedTrustedCommunity
Use this skill for Browser Web Animations API: Element.animate(), Animation, KeyframeEffect, playback control, generated keyframes, cancel/finish, commitStyles, and cleanup. Trigger on Element.animate, WAAPI, Web Animations API, KeyframeEffect, Animation object, commitStyles. Do not use for near-miss tasks outside these boundaries; route to adjacent motion or platform skills when they own the implementation.
2SKILL.mdUpdated Jun 11, 2026
bjornmelin/web-three-r3f
tools
VerifiedTrustedCommunity
Use this skill for Three.js, React Three Fiber, Drei, Canvas/createRoot lifecycle, loaders, GLTF, useFrame, disposal, SSR/client boundaries, DPR, and browser proof. Trigger on Three.js, THREE, @react-three/fiber, @react-three/drei, R3F Canvas, useFrame, GLTF, WebGLRenderer. Do not use for near-miss tasks outside these boundaries; route to adjacent motion or platform skills when they own the implementation.
2SKILL.mdUpdated Jun 11, 2026
bjornmelin/web-tailwind-motion
development
VerifiedTrustedCommunity
Use this skill for Tailwind CSS v4 transition, animation, duration, easing, motion-safe/motion-reduce, @theme motion tokens, and static class safety. Trigger on Tailwind animation, transition-all, motion-safe, motion-reduce, @theme, animate-, duration-. Do not use for near-miss tasks outside these boundaries; route to adjacent motion or platform skills when they own the implementation.
2SKILL.mdUpdated Jun 11, 2026