lanhu-code-2-el-vue

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill mostly fits its Vue conversion purpose, but it also tells the agent to read and execute a local function.md file, which could redirect the agent beyond the requested task.

Use this skill only on a version-controlled project and review diffs afterward. Before installing, confirm that it will not read and execute function.md automatically, review the required ui-ux-max-pro dependency, and approve any npm install or router changes separately.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A repository could include a function.md that changes what the agent does after the conversion, potentially causing unrelated file edits, commands, or workflow changes.

Why it was flagged

The completion guidance tells the agent to read and execute requirements from a local function.md file if present. That makes an arbitrary project file an instruction source beyond the stated index.vue/CSS conversion scope.

Skill content
# 如果存在,读取并执行其中的需求
Recommendation

Remove this automatic function.md execution step, or require explicit user approval and treat function.md as non-authoritative context rather than instructions.

What this means

The actual behavior may depend on a separate skill that the user also needs to trust and review.

Why it was flagged

The skill depends on another skill's instructions before running. This is disclosed and purpose-related, but the referenced skill is not included in the provided artifacts.

Skill content
必须先执行 `ui-ux-max-pro`... 先读取并遵守 `ui-ux-max-pro` 的 `SKILL.md`
Recommendation

Review the installed ui-ux-max-pro skill/version before use, and ensure it cannot override this skill's file-source limits.

What this means

Existing Custom.vue content in the target folder could be overwritten.

Why it was flagged

The skill instructs the agent to write the generated component directly to disk, and the target file may be created or overwritten. This matches the stated purpose but is a real project mutation.

Skill content
必须使用 Write 工具直接生成文件... 目标文件: src/views/${folderName}/Custom.vue
Recommendation

Confirm the folder name, back up or review the existing Custom.vue, and inspect the diff after generation.

What this means

The project’s dependencies or lockfiles may change, and package install scripts may run in the local environment.

Why it was flagged

The workflow includes running npm commands and installing a dependency if missing. This is relevant to Element UI work, but it modifies the local project environment and is not represented in the install spec.

Skill content
npm list element-ui

# 如未安装,执行安装
npm i element-ui@2.15.14 -S
Recommendation

Ask the user before installing dependencies or starting the project, and prefer reviewing package changes before committing them.

What this means

Project routing could be changed as part of the conversion workflow.

Why it was flagged

The skill allows route-file access after writing Custom.vue. This is plausibly useful for making the page reachable, but it expands mutation authority beyond the generated component.

Skill content
允许打开项目路由文件(如 `src/router/index.js`)仅用于登记或校验 `index.vue` / `Custom.vue` 的访问路径
Recommendation

Require explicit approval before route edits and review any router diff separately from the generated component.