| Fetching without confirming project root | Always resolve cwd first; ask user if ambiguous |
Overwriting existing DESIGN.md silently | Always warn + confirm |
Modifying CLAUDE.md without consent | Default is ask-first; never auto-append |
| Hardcoding the commit SHA | Always read from config.json → pinned_commit |
| Bundling upstream files into the skill | Skill is index-only — never copy design-md/ into the skill dir |
| Guessing slugs | Always check references/catalog.md (slugs have irregular forms) |
| Skipping section 9 in the report | The agent prompt examples are the highest-leverage takeaway |
| Showing section 9 without philosophy framing | Always remind to read sections 1, 5, 7 first |
| Omitting stack-aware hint | Detect framework and suggest how to adapt CSS values |
| Omitting AI slop warning | Always append the generation pitfalls advisory |
Fetching preview.html to the project | Only DESIGN.md belongs in the project; previews are for eyeballing on github.com |
| Pushing shadcn on non-shadcn projects | Step 7 must call get_project_registries first; empty result = non-shadcn advisory |
| Skipping non-shadcn framework advisory | When shadcn detection fails, check for Vue/Svelte/Flutter and offer a one-line token-application hint |
Auto-running npx shadcn add ... commands | Step 7c prints install commands; the user runs them |
Forcing ui-ux-pro-max when it isn't installed | Step 6 must check the available skills list before invoking |
Silently skipping step 6 when ui-ux-pro-max missing | Surface the install pointer (https://github.com/nextlevelbuilder/ui-ux-pro-max-skill) once, then stop — do NOT no-op |