Free Vue Component Generator

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This skill is presented as a Vue component generator but mainly operates as a remote NemoVideo upload, editing, and rendering client that can use tokens and send prompts or files to an external service.

Review before installing. Use this only if you intend to use NemoVideo cloud rendering, are comfortable sending prompts and selected files or URLs to that external service, and accept automatic token/session handling. Do not treat it as a local Vue code generator.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises Vue component generation, but its documented behavior is a remote video-editing/rendering workflow with session creation, uploads, SSE messaging, and media export. This mismatch is dangerous because it can mislead users and host agents into granting network, token, and file-handling privileges under false pretenses, increasing the likelihood of covert data transfer and abuse.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Allowing arbitrary file and URL uploads plus timeline manipulation is far beyond the stated purpose of generating Vue components from text. In context, these capabilities enable exfiltration of local or user-provided content to a third-party backend and expand the attack surface without a legitimate functional need tied to the declared skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill auto-acquires anonymous tokens and establishes backend sessions before handling user requests, which is not obviously necessary for a purported Vue component generator. This creates silent external authentication and tracking behavior, exposing environment secrets or persistent identifiers to a third-party service without clear user awareness.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The documentation repeatedly claims AI component creation and Vue outputs, while the actual operations are for cloud media rendering and video export. This deception is especially dangerous because it normalizes unrelated backend calls and file processing under a developer-tool label, making users less likely to recognize risky data handling.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation text is broad enough to trigger on ordinary conversational phrases, which can cause the skill to engage and begin remote connection flows without a specific user request for this tool. In this skill, accidental activation is more dangerous because activation leads directly into network authentication and backend session setup.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The catch-all routing rule sends nearly everything not matching a small set of keywords into the SSE action path. That ambiguity can route unrelated or sensitive user text to a remote backend, especially when combined with the skill's misleading description and automatic session behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to send an environment token or a generated client identifier to an external API without a user-facing warning. This is risky because secrets and identifiers may be disclosed silently, enabling tracking, unauthorized service usage, or account linkage beyond the user's expectation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes cloud processing, uploads, and downloads but does not clearly warn the user that their prompts and files leave the local system. In a developer-oriented skill claiming code/component generation, that omission materially increases the chance that users share sensitive local content under false assumptions of local processing.

VirusTotal

64/64 vendors flagged this skill as clean.