lanhu-code-2-el-vue

• Outcome: Review
• Latest audit: May 28, 2026 · 1:33 PM UTC
• Version: 1.0.0

Overview

This skill is a legitimate Vue conversion helper, but it includes under-scoped instructions that can overwrite files, edit routing, install dependencies, and potentially follow an extra function.md file outside the advertised source boundary.

Review before installing. Use it only in a disposable branch or with backups, and require the agent to ask before overwriting Custom.vue, editing router files, running npm install, starting the project, or reading/executing any function.md file. No artifact-backed exfiltration or destructive malware behavior was found, and VirusTotal was only pending telemetry.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill claims a tightly limited source scope, but elsewhere instructs the agent to consult additional `data/` documents and later inspect route files. This mismatch weakens the safety boundary and can cause the agent to access broader repository content than the user would reasonably expect from the stated constraints.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a page-conversion tool that generates `Custom.vue`, but the workflow also mandates route registration and validation in `src/router/index.js`. This expands both read and write scope beyond the advertised task and can lead to unanticipated repository modifications.

Scope Creep

High

• Confidence: 99% confidence
• Finding: This instruction authorizes modifying router configuration even though the skill frames `Custom.vue` as the operational target and forbids other repository files as references. Allowing exceptions that both read and write outside the declared boundary creates a policy bypass and increases the risk of unintended project-wide changes.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill tells the agent not to open other engineering files, but later requires opening router files and many `data/` documents. Contradictory instructions like this undermine reliable enforcement of repository boundaries and make it easier for an agent to justify over-reading or over-modifying files.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The instruction expands the skill's scope from transforming a Vue page into performing environment maintenance and launching the project. That creates unnecessary side effects, increases operational risk, and can trigger package installation or startup scripts that are unrelated to the user-requested transformation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: Directing the agent to read and execute requirements from function.md contradicts the declared restriction that only index.vue, referenced CSS, and asset paths may be used. This bypasses the skill's trust boundary and allows hidden repository content to inject new instructions or actions beyond the intended task.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: Referencing a different analysis skill name than the manifest creates ambiguity about which prerequisite workflow should run. In practice this can cause the wrong skill to be invoked, weakening control assumptions and making the behavior less predictable and less auditable.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The inline documentation explicitly tells the agent to check for function.md and execute its requirements, even though the skill description prohibits referencing other repository files. This is dangerous because it enables instruction smuggling through auxiliary files and can silently expand the agent's behavior to unauthorized tasks.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill metadata says the page conversion must use only index.vue, its referenced CSS, and resource paths as source material, but this guide later requires consulting additional repository files such as data/class-naming.md and data/element-ui-style.md. That widens the model's effective read scope beyond the declared trust boundary and creates a prompt-scope integrity issue, allowing extra in-repo instructions to influence generation unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The guide instructs the agent to run npm list and potentially npm install element-ui, which exceeds the stated task of transforming a Vue page and introduces package-management side effects. Allowing an agent skill to modify project dependencies can change the environment, trigger network/package execution behavior, and violate least-privilege expectations for a code-transformation workflow.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: This file contains conflicting authority: one section tells the agent to install Element UI itself, while another says project-level dependency changes should be handled by the user. Such contradictions are dangerous in agent skills because they create ambiguous execution boundaries, increasing the chance the model takes higher-risk actions despite a later limitation.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill metadata restricts inputs to index.vue, its referenced CSS, and asset paths, but these instructions explicitly direct the agent to consult another repository file (`data/element-ui-style.md`). That expands the trust boundary and can cause unauthorized repository context to influence outputs, undermining source-scoping guarantees and potentially leaking or incorporating unintended content.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This instruction tells the agent to use `data/class-naming.md` to resolve class naming behavior, even though the manifest says repository references must be limited to index.vue, referenced CSS, and assets. Such hidden cross-file dependencies break isolation assumptions and let out-of-scope files steer code generation or expose unrelated repository data.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad and loosely phrased, making accidental invocation more likely for requests that only partially match the intended use case. Because the skill performs direct file writes and can also alter routing, overbroad triggering materially increases the chance of unwanted repository changes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill directs immediate file creation and route modification without an explicit warning that repository files will be changed. In an automated agent context, hidden side effects reduce informed consent and increase the risk of destructive or surprising edits.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill permits creating or overwriting `Custom.vue` with no confirmation or overwrite safeguard. This can destroy existing work product, especially if the skill is triggered accidentally or run against a folder that already contains a curated `Custom.vue`.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill mandates route-file updates as part of delivery but does not clearly warn the user that additional project files outside the target component will be modified. This increases the likelihood of unexpected changes to shared application behavior and routing stability.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The requirements are written entirely in Chinese and the skill description also presumes Chinese-language operation, without any indication that the user can choose another language or opt in to that constraint. This can cause users to misunderstand security-relevant instructions, validation steps, or file-operation restrictions, which increases the risk of incorrect execution and unsafe modifications.

Static analysis

No suspicious patterns detected.