Skip to content
Back to skills

Kokonutui Pro

DSecurity

KokonutUI Pro setup and component installation — per-project shadcn/ui registry config, KOKO_PRO_TOKEN handling, and the complete component slug index (references/index.md). Use when setting up KokonutUI Pro in a project, adding components, or debugging registry auth/404 errors. Triggers on "kokonutui", "@kokonutui-pro", "koko", "KOKO_PRO_TOKEN", "shadcn add @kokonutui-pro", "kokonutui component", "kokonutui einrichten", "kokonutui komponente hinzufügen", "koko pro registry".

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 27, 2026
developmentgoshellbashnextjstestingdebuggingapi

Works with

  • claude code
  • terminal
  • api
  • mcp

Security analysis

D46/100
  • criticalModifies startup scripts or system services for persistence
  • criticalSends environment variables or credentials to an external URL
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 2 files and shows the line behind each finding

Scanned September 27, 2026

npx -y skills add emanuelrechsteiner/claude-rcode --skill kokonutui-pro --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Kokonutui Pro?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Kokonutui Pro
[![Security: D — Skills Directory](https://www.skillsdirectory.com/api/skills/emanuelrechsteiner-kokonutui-pro/badge)](https://www.skillsdirectory.com/skills/emanuelrechsteiner-kokonutui-pro)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: kokonutui-pro
description: KokonutUI Pro setup and component installation — per-project shadcn/ui registry config, KOKO_PRO_TOKEN handling, and the complete component slug index (references/index.md). Use when setting up KokonutUI Pro in a project, adding components, or debugging registry auth/404 errors. Triggers on "kokonutui", "@kokonutui-pro", "koko", "KOKO_PRO_TOKEN", "shadcn add @kokonutui-pro", "kokonutui component", "kokonutui einrichten", "kokonutui komponente hinzufügen", "koko pro registry".
---

# KokonutUI Pro Setup

> KokonutUI Pro is a per-project shadcn/ui registry, not a global install. On-demand skill — demoted from always-loaded rule per IMP-079 (2026-07-03).

## The Rule

**The `KOKO_PRO_TOKEN` is globally available** (exported in `~/.zshrc` from `~/.koko_pro_token`, chmod 600) — no setup needed there.

**KokonutUI Pro itself is NOT global.** Each project needs its own Tailwind + shadcn/ui config with the registry block. Components are pulled on-demand via `npx shadcn add`.

## Per-Project Setup Checklist

Every project that uses KokonutUI Pro needs:

1. **Tailwind CSS** — installed and configured
2. **shadcn/ui** — initialized (`components.json` present at project root)
3. **The `@kokonutui-pro` registry block** in `components.json`

### Required `components.json` Registry Block

```json
{
  "registries": {
    "@kokonutui-pro": {
      "url": "https://kokonutui.pro/api/r/{name}",
      "headers": {
        "X-API-Key": "${KOKO_PRO_TOKEN}"
      }
    }
  }
}
```

The token is read from the environment at install time — `${KOKO_PRO_TOKEN}` resolves via the shell export in `~/.zshrc`.

### Adding a Component

```bash
npx shadcn add @kokonutui-pro/<component-name>
```

Example:
```bash
npx shadcn add @kokonutui-pro/animated-card
```

## Common Mistakes

### ❌ Assuming KokonutUI Pro works globally after token setup
The token is global; the registry config is not. A fresh project without `components.json` or the registry block will fail with an auth or "registry not found" error.

### ❌ Hardcoding the token value in `components.json`
Use `$KOKO_PRO_TOKEN` (env-var reference), not the literal token string. Prevents accidental commits.

### ❌ Running `npx shadcn add @kokonutui-pro/...` before `components.json` exists
Initialize shadcn/ui first: `npx shadcn init`. Then add the registry block. Then pull components.

## Quick Start for a New Project

```bash
# 1. Install Tailwind (framework-specific — e.g. Next.js)
npm install -D tailwindcss postcss autoprefixer
npx tailwindcss init -p

# 2. Initialize shadcn/ui
npx shadcn init

# 3. Add the kokonutui-pro registry block to components.json (see above)

# 4. Pull a component
npx shadcn add @kokonutui-pro/<component-name>
```

## Token Source — TWO places

1. **`~/.koko_pro_token`** (chmod 600, never committed) — single source of truth.
2. **`~/.zshrc`** → `export KOKO_PRO_TOKEN=$(cat ~/.koko_pro_token)` — this is what
   actually delivers the token to Claude Code's tools.

### ⚠️ CORRECTION 2026-08-04 — the third location was a dead letter box

This section previously demanded a **third** location, `~/.claude/settings.local.json`
→ `env.KOKO_PRO_TOKEN`, and called it "REQUIRED for Claude Code's tools". **That was
wrong on both counts, and the verification that "confirmed" it was a false positive.**

- **Claude Code does not read `~/.claude/settings.local.json`.** The `local` settings
  scope exists only **per project** (`.claude/settings.local.json` at a repository
  root) — see `code.claude.com/docs/en/settings`. There is no user-level equivalent.
- **Measured 2026-08-04:** the same file's `env` block also held
  `NOTION_PARENT_PAGE_ID`, which appears in **no** other source. It is **not set** in
  the session environment. Had the file been read, it would be.
- **Why the old check passed anyway:** `KOKO_PRO_TOKEN` was written to `~/.zshrc`
  **and** to `settings.local.json`. The verification below prints a non-empty value
  either way, so it credited the wrong source. Two wires, one lamp, only one of them
  carrying current — and the test only looked at the lamp.

**Where a value has to go instead:**

| Consumer | Working location |
|---|---|
| Claude's Bash tool, MCP servers, subagents (session started from a terminal) | `~/.zshrc` export |
| Something that must work **without** a shell profile (headless / scheduled runs) | `env` block in `~/.claude/settings.json` — **never for a secret**, that file is committed to a public repo |

> **General principle (revised): secrets belong in the shell profile, sourced from a
> chmod-600 file — never in any committed settings file.** The old principle named a
> file with no effect, which is worse than naming none: it reads as solved.

Verification (inside Claude's Bash, after a restart): `echo "${KOKO_PRO_TOKEN:-EMPTY}"`
must NOT print EMPTY. **This check alone proves only that *some* source works** — if
you are testing a specific location, remove the others first.

## Finding the correct component slugs

**The complete component index ships with this skill: `references/index.md`** (100 components, grouped by category). Slugs were taken verbatim from each page's official `shadcn add` command. Check it FIRST before installing anything.

Install any of them with:
```bash
npx shadcn add @kokonutui-pro/<slug>
```

### Regenerating the index (if it goes stale)

The Pro registry endpoint (`/api/r/{name}`) has **no public index** and the docs 403 plain HTTP fetchers — but **Firecrawl can read the pages** (real browser). To rebuild:
1. `firecrawl map "https://kokonutui.pro" --json` → discover category pages under `/docs/components/<category>`.
2. `firecrawl scrape` each category page → each lists its variants with their `@kokonutui-pro/<slug>` add command.
3. `grep -ohE '@kokonutui-pro/[a-z0-9-]+'` across the scraped `.md` files, `sort -u`.

Do NOT slug-guess against the registry: every wrong guess returns 404 even with valid auth, and the page-path ≠ registry-slug (e.g. page `footer/footer-01` but slug `footer-04`; `testimonials-01` page → slug `testimonial-01`).

## References

- Component slug index: `references/index.md` (in this skill)
- KokonutUI Pro registry endpoint: `https://kokonutui.pro/api/r/{name}` (auth header `X-API-Key: ${KOKO_PRO_TOKEN}`)
- KokonutUI Pro docs: https://kokonutui.pro/docs
- shadcn/ui registry docs: https://ui.shadcn.com/docs/registry

Files in this skill

  • SKILL.md6.3 KB
  • references/index.md2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…