
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
ui-clone-cli
Advanced tools
ui-clone-skills is motion forensics for the animated web: an agent skill for Claude Code and Codex by @voidmatcha that investigates a live URL the way a forensic analyst investigates a binary — extracts real CSS and real animation parameters from JS bundles (GSAP, Framer Motion, Lenis, anime.js), then either explains them, emits production React + Tailwind code, or scores an existing impl against the original via AE/SSIM pixel diff. No screenshot input, no vision tokens for routine verification.
| Command | Job |
|---|---|
decode <url> | Analyse motion + build: which animation library, which scroll engine, what timings. Educational — no code emitted. |
clone <url> | Generate React + Tailwind components against the captured DOM + extracted animation params. |
verify <url> <impl> | Score an existing impl against the ref with AE/SSIM + motion-parity. Third-party clone audit. |
extract <url> | Raw JSON dump (structure, styles, animations, bundles) for downstream tooling. |
Screenshot-to-code and prompt-driven UI tools generate components that look like the original at a glance but ship the wrong transitions, wrong scroll behavior, and broken responsive breakpoints — visible parity, hidden divergence. Input is a live URL, not a screenshot or design file. Supports Next.js, Tailwind v4, Webflow IX2, and scroll-driven animations.
getComputedStyle when CSS is obfuscated (Tailwind, CSS-in-JS). Auto-detects site type.ui-reverse-engineering · ui-capture · visual-debugDifferent inputs need different tools. Pick by what you have:
| What you have | Use |
|---|---|
| A live URL and want pixel-faithful React + Tailwind (real CSS, real animation params, scroll/hover behavior) | ui-clone-skills ← you are here |
| A Figma file | Builder.io / Anima / Plasmic |
| A screenshot (no source available) | screenshot-to-code / v0 |
| A text description (no reference) | Claude Code / v0 / Lovable / Bolt.new |
| A live URL and just want static HTML mirror (no React) | wget --mirror / HTTrack |
Why this exists: prompt-/screenshot-driven tools approximate what's visible.
ui-clone-skillsdownloads the actual stylesheet, runsgetComputedStyleagainst the rendered DOM, greps the JS bundle for GSAP/Framer Motion/anime.js/Lenis parameters, and verifies the result against the original via AE/SSIM — so the output matches transitions and responsive behavior, not just the static layout.
When NOT to use: general "build me a UI from scratch" tasks (use v0/Lovable or Claude Design), Figma-driven workflows (use Builder/Anima), one-off CSS help (just ask Claude directly).
These are the decisions that shape how the plugin is structured. They aim to keep agent sessions focused and bounded.
getComputedStyle, raw CSS, or a JS bundle grep. The plugin refuses to ship approximations.transition-spec.json is produced once from bundle analysis. Implementation reads the spec, never re-greps the bundle — avoiding wasted work and the risk of picking the wrong conditional branch.npx ui-clone-cli, compatibility: python -m ui_clone.*, plus scripts/verify/auto-verify.sh) decide whether a step is complete. Agents don't self-certify "looks good enough."| User intent | Skill | Owned responsibility | Non-goal | Handoff/next action |
|---|---|---|---|---|
| Build/route | ui-reverse-engineering | Run the website-to-React pipeline and route the next phase from pipeline status. | Not a standalone capture utility or mismatch diagnosis tool. | Calls ui-capture for reference artifacts; uses visual-debug for visual verification. |
| Capture/reference | ui-capture | Capture reference screenshots, scroll/transition evidence, and optional implementation clips for the caller. | Not the primary post-implementation mismatch diagnosis tool. | Handoff failing diffs or mismatch investigation to visual-debug. |
| Diagnose mismatch | visual-debug | Compare original vs implementation, run AE/SSIM/computed-style diagnosis, and identify fixes. | Not the build pipeline or baseline capture owner. | Return concrete findings/fixes to ui-reverse-engineering or the caller. |
Start with ui-reverse-engineering when the request begins with a live URL, when you're unsure which skill fits, or when a run is partial, failed, or already complete. It checks the current state first, then routes to capture, generation, verification, or mismatch diagnosis without discarding usable artifacts.
Call ui-capture directly only when you need fresh reference evidence. Call visual-debug directly only when reference and implementation evidence already exist and the task is to diagnose a mismatch.
The public surface stays small: Claude Code and Codex expose the same three skills from shared skills/; each host adapter points back to the same core scripts, gates, and hooks.
tmp=$(mktemp) && curl -LsSf -o "$tmp" https://raw.githubusercontent.com/voidmatcha/ui-clone-skills/main/install.sh && bash "$tmp" && rm -f "$tmp"
The default install registers both Claude Code and Codex marketplaces in one pass; each registration is skipped silently if that host's CLI is not on PATH. Both hosts are pointed at the same lightweight local projection under ~/plugins/ui-clone-skills, not at the development checkout, so tmp/, scratch/, .venv, and other local artifacts are never copied into plugin caches. For Claude Code, the installer also installs the plugin (ui-clone-skills@voidmatcha, user scope) — new Claude Code sessions load it automatically. For Codex, the installer also merges the gate hooks into ~/.codex/hooks.json (codex-cli 0.137 removed the plugin_hooks feature, so plugin-manifest hooks no longer load) — accept the one-time hook-trust prompt on the next Codex session.
For one-host installs, using a local development checkout as the plugin source, the manual git-clone path, the SKILL.md-only no-hooks copy, and the manual system-deps recipe, see README_detail/install.md.
Tested on: macOS 14+ (primary), Ubuntu 22.04+ via WSL2 or native Linux. Windows native is not supported — use WSL2.
| Dep | Why |
|---|---|
agent-browser | Browser automation for extraction + comparison |
imagemagick | AE pixel comparison |
dssim | Structural visual similarity (perceptual diff) |
ffmpeg | Video capture + frame extraction |
uv + Python 3.11+ | Gate / hook system (ui_clone/) |
Pipeline hooks register through the Claude Code plugin source's hooks/hooks.json and, for Codex, via install.sh merging hooks/codex-hooks.json into ~/.codex/hooks.json (codex-cli 0.137 removed the plugin_hooks manifest path). For the full hook table, the goal-driven continuation pattern, and the gate-system CLI, see README_detail/pipeline.md.
After installing, give the agent a URL and a target. Use ui-reverse-engineering as the default entrypoint for live URL work, uncertain routing, partial runs, failed verification, or completed-state follow-up:
Clone the hero section from https://stripe.com/payments into React + Tailwind. Output to ./out/
The pipeline runs automatically. npx ui-clone-cli ... status --json (compatibility: python -m ui_clone.pipeline) detects the current phase and prints the next action; you don't invoke phases manually. See docs/agent-cli.md for the agent-readable CLI contract.
What happens:
tmp/ref/payments-hero/{full,desktop,tablet,mobile}.png + scroll videotmp/ref/payments-hero/{structure,styles,assets}.json + transition-spec.json./out/PaymentsHero.tsx (CSS-first, original class names)scripts/verify/auto-verify.sh → D0 layout health + AE/SSIM diffIf verification fails, the pipeline iterates up to 3 rounds (Phase H self-healing loop) before asking for human review.
Hooks are registered on install and both Claude Code and Codex route through hooks/shim.sh, so premature write blocks and unverified-completion warnings stay shared. Claude Code loads them from the installed plugin source's hooks/hooks.json. Codex loads them from ~/.codex/hooks.json, into which install.sh merges the gate entries (idempotently) — plugin_hooks was removed in codex-cli 0.137 and is no longer used. Re-run install.sh after pulling hook-registration changes; plain script-logic edits are picked up live via the install marker on the next session.
Each skill ships with a dedicated detail page documenting its pipeline phases, automation scripts, and input modes:
ui-reverse-engineering — full website-to-React pipeline (Phase 0 → 9), repo automation scripts, visual-debug script reference, input modesui-capture — baseline screenshots, per-trigger transition capture, optional implementation evidence handoffvisual-debug — quick comparison vs full verification, Phase E semantic reviewENABLE_PROMPT_CACHING_1H=1 setup per shell + plan, rtk integrationAll skills include eval suites following skill-creator conventions, at skills/*/evals/.
See CHANGELOG.md.
Apache-2.0. See LICENSE.txt.
FAQs
Agent-readable CLI for ui-clone-skills pipeline, gates, and terminal state.
We found that ui-clone-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.