Make Bot UI
An agent skill by cursor, from cursor/plugins. Tags: automation, integration, slack, ui-ux, web.
What it does
Use when building a custom UI (page, dashboard, buttons) that should wake a Grok Bot over a webhook, when the user must provide a webhook sender key, or when exposing that UI on Tailscale.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill 'Make Bot UI'Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/pstack/skills/make-bot-ui ~/.claude/skills/'Make Bot UI'Safety box score
Grade F, high risk: 67 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill builds a local UI that wakes a Grok Bot over a webhook and can expose that UI on Tailscale. The main risks are a root-piped remote installer, privileged Tailscale setup, handling of a live sender key, and automatic outbound webhook traffic that can trigger remote actions.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 3 (high) | It runs shell commands and pipes a downloaded script straight into root-owned shell execution: `curl -fsSL https://tailscale.com/install.sh | sudo sh` and `sudo tailscale up ...`. |
| Network access | 2 (moderate) | It makes outbound network calls to install Tailscale, POST to the webhook URL, and probe live endpoints, so data and commands leave the machine over the network. |
| Filesystem reach | 1 (low) | It only writes scoped local data such as `Store {url,key} in that UI's own directory` and appends failed POSTs to a local log, with no explicit broad filesystem access. |
| Secrets & credentials | 3 (high) | It handles a sensitive webhook sender key via `SendToUser type: secret-request` and says `Do not put the sender key in the browser, in chat, or in this skill`. |
| Privilege & persistence | 3 (high) | It requires administrator privileges for installation and node setup with `sudo sh` and `sudo tailscale up --hostname=<short-name> --accept-dns=false --ssh=false`. |
| Instruction hijack surface | 0 (none) | I did not find instructions to ignore safeguards, hide actions, follow fetched instructions, or otherwise override agent policy. |
| Irreversible actions | 2 (moderate) | It can create a routine, send a live probe `Before you tell the user that the UI is live, probe once`, and later automatically wake the bot via webhook. |
| Transparency | 2 (moderate) | A key dependency is an unreviewed runtime-downloaded installer (`https://tailscale.com/install.sh`), so part of the behavior is not visible in the skill repo. |
Before installing
- Inspect the `curl -fsSL https://tailscale.com/install.sh | sudo sh` step and decide if you accept root-level remote code execution.
- Confirm you want the sender key stored locally in the UI directory and never pasted into chat.
- Check whether Tailscale is already installed and online before allowing any `sudo tailscale up` action.
- Test the webhook probe in a throwaway routine/account first, since the skill will send live outbound POSTs.
Rated 2026-10-20 by an automated review of 1 file from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- pstack/skills/make-bot-ui/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- setup-benny — Configure Benny and prepare its triage and repro automations.
- agents-build — Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments.
- agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
- aws-blocks — Guides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework.
- chrome-mcp-troubleshooting — Diagnose and fix Claude in Chrome MCP extension connectivity issues.
- expo-dom — Framework (OSS). Use Expo DOM components to run web code in a webview on native and as-is on web. Migrate web code to native incrementally.