beUI is a React and Next.js component library whose animated interface components come with previews, examples, source code, and shadcn installation commands. Developers copy the components into their own applications and keep the code there. Catalogue add-ons help coding agents find and use existing beUI components.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add starc007/ui-components --skill beui-progit clone --depth 1 https://github.com/starc007/ui-componentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/starc007/ui-components/beui-pro)<a href="https://agentmods.dev/skills/starc007/ui-components/beui-pro"><img src="https://agentmods.dev/badge/skills/starc007/ui-components/beui-pro/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/starc007/ui-components/beui-pro"><img src="https://agentmods.dev/badge/skills/starc007/ui-components/beui-pro.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 102 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 119 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.01736 |
| Opus 5.5 | $0.00034 | $0.00694 |
| Sonnet 5.5 | $0.00017 | $0.00347 |
| Haiku 4.5 | $0.00009 | $0.00174 |
Grade A, and why
beui-pro scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsS \ How it starts
The opening of the file, as written. The whole thing — 176 lines — stays where its author put it; the contents beside it link to each section on GitHub.
beUI Pro
Use the customer's live licensed beUI Pro catalog as the source of truth. Discover current items at runtime, install only the blocks the project needs, then compose and adapt the source.
Choose an access path
Follow the current agent access documentation for connection instructions.
- MCP: Use an existing authenticated connection to
https://mcp.beui.dev/pro/mcp. OAuth-capable clients open beUI's approval page, where the user enters their license key. Clients with custom headers can also use bearer authentication. A working MCP connection does not require a separate token in the agent's shell. - Direct registry or shadcn CLI: Follow the installation documentation. This path requires
BEUI_PRO_TOKENin the command environment and private registry configuration for namespaced CLI commands.
Prefer an available authenticated MCP connection. Do not replace it with token setup just because the shell has no token.
Protect access
- Require
BEUI_PRO_TOKENonly for direct registry requests or CLI installs, not for authenticated MCP calls. - Never print, paste, commit, or write the token into source files.
- Never accept a token copied into the user's prompt. For OAuth, the user enters the key only on beUI's approval page.
- If MCP authentication is missing or expired, use the client's native authentication flow. Never extract its stored OAuth credentials for shell commands.
- If using the direct registry path and the token is unavailable, ask the user to configure it. Do not replace a requested Pro block with an approximation.
- If the live catalog cannot be fetched, do not present remembered, documented, or locally inferred slugs as the current catalog.
- On
401, restore authentication for the chosen path. Treat404as a stale or incorrect install slug and refresh the catalog.
For direct registry access only, check token presence without revealing its value:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +26 lines · +2 tokens per session 4e23a8bf68c0
- 1mo ago First seen · 150 lines · 83 tokens per session scan A e7b6df93bdc3
beui-pro is a skill published in the GitHub repository starc007/ui-components (1,819 stars, last pushed today), licensed MIT. It adds 85 tokens to every session and 1,736 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
shadcn
Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. Applies when working with shadcn/ui, component registries, presets, --preset codes, or any project with a components.json…
migrate-radix-to-base
Migrates React projects and components from Radix UI to Base UI. Use when asked to migrate from radix, move to base-ui, convert radix primitives, or switch a shadcn project's base library. Handles single components ("migrate accordion") and whole projects.
magic-ui
Use this skill when users want to add, customize, or troubleshoot Magic UI components in React/Next.js projects. It covers component selection, shadcn registry installation (@magicui/), integration patterns, and practical quality checks for accessibility and maintainability.
tamagui-upgrade-v3
Migrate an app from Tamagui v2 (or v1) to v3. Use when upgrading Tamagui versions, removing $ token prefixes, converting hoverStyle/pressStyle/media/theme/platform condition objects to flat values, running the flat-values codemod, or fixing v3 breaking changes. Triggers: "upgrade tamagui", "migrate to v3", "flat…
tamagui
Universal React UI framework for web and native with flat conditional values. Use when building cross-platform apps with Tamagui, writing styled components, or applying tokens, themes, animations, and media queries.
tamagui-v6-config
Tamagui v6 theme system: the light/dark/accent/brand/inverse/level/active theme family, the background-active one-off key, and recipe-tree authoring with createV6Config. Use when choosing a theme for a surface, building a selected/emphasis state, or authoring a custom v6 colors pack.