vue-spa-state

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only Vue/Pinia state-management skill, but it includes unsafe guidance around persisting auth tokens and sending user IDs.

Install only if you are comfortable reviewing generated auth and telemetry code carefully. Do not let the skill persist access or refresh tokens in localStorage/sessionStorage, and require explicit review of any code that sends user IDs or analytics events.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:171

Finding

Unnecessary Transmission of a User Identifier to an Unspecified Network Destination

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 171-174
Vulnerability Type: Privacy-sensitive data transmission beyond the Skill's minimum functional scope
Risk Level: Medium

Vulnerable Code

ts

export const trackEvent = (name: string) => {
  const user = useUserStore()
  send({ name, uid: user.id })
}

Technical Analysis

The example retrieves a user identifier from globally shared application state and passes it to an unspecified send function. The destination, transport security, authorization, user consent, retention policy, and identifier handling requirements are not defined.

The declared purpose of the Skill is to advise on Vue and Pinia state management. Transmitting a user identifier is not necessary to demonstrate obtaining a store after Pinia installation. Consequently, this example exceeds the minimum privileges and data access required for the Skill's stated functionality.

The snippet is documentation rather than an executable implementation, so it does not prove that data is currently being sent to a malicious endpoint. However, an AI agent or developer could copy the pattern into an application and connect send to an analytics or telemetry service without appropriate privacy controls.

Attack Path

1. An agent or developer uses the tracker example while implementing a Vue application.
2. The application reads user.id from the globally available user store.
3. The unspecified send function is connected to a remote analytics, logging, or telemetry endpoint.
4. User identifiers are transmitted without explicit consent, destination validation, or data-minimization controls.
5. A compromised, incorrectly configured, or untrusted endpoint can collect the identifiers and correlate user activity.

Impact Assessment

Exploitation does not grant local system privileges or code execution. The affected scope is application privacy and confidentiality. A remote ...[truncated 284 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the networked tracker with a side-effect-free example that demonstrates delayed store access without transmitting user data.
• If telemetry is genuinely required, document and enforce an allowlisted HTTPS destination.
• Do not transmit a direct account identifier by default. Use a short-lived, pseudonymous identifier where correlation is necessary.
• Require explicit user consent where applicable and provide a mechanism to disable telemetry.
• Define permitted event fields, retention limits, access controls, and deletion procedures.
• Validate that event payloads cannot accidentally include tokens, profile data, or other sensitive store fields.
• Make telemetry failure non-blocking and avoid logging complete payloads containing identifiers.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:208

Finding

Unsafe Guidance to Persist Authentication Tokens in localStorage

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 208
Vulnerability Type: Insecure client-side storage of authentication credentials
Risk Level: Medium

Vulnerable Guidance

md

- **要记住的**（token、主题）：persist 插件或自己读 `localStorage`，只持久化最小字段。

In English, this guidance recommends using a persistence plugin or directly reading localStorage for values that include authentication tokens and themes, while persisting only the minimum fields.

Technical Analysis

The guidance groups authentication tokens with ordinary, non-sensitive preferences suitable for browser storage. Data in localStorage is accessible to JavaScript executing in the same origin. Therefore, any successful cross-site scripting vulnerability, compromised third-party script, or malicious browser-side dependency can read and exfiltrate a persisted bearer token.

Persisting fewer fields does not protect the token itself. A bearer token is sufficient for authentication wherever it is accepted, so disclosure may permit direct session or account impersonation until the token expires or is revoked.

The repository does not itself store a real token or contain executable token-exfiltration code. The risk arises because the Skill can direct an AI agent to generate applications with insecure credential storage.

Attack Path

1. An agent follows the Skill's guidance and persists an authentication token through a Pinia persistence plugin or direct localStorage access.
2. A separate XSS flaw, compromised third-party script, or malicious same-origin JavaScript executes in the application.
3. The script reads the persisted token through localStorage or the persistence plugin's storage record.
4. The script sends the token to an attacker-controlled server.
5. The attacker presents the bearer token to application APIs and acts with the permissions assigned to the victim's session until expiration or revocation.

Impact Assessment

...[truncated 415 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly prohibit storing authentication or refresh tokens in localStorage, sessionStorage, or ordinary Pinia persistence records.
• Prefer server-issued cookies configured with HttpOnly, Secure, and an appropriate SameSite policy.
• When cookie-based authentication is used, implement suitable CSRF protections, including SameSite controls and anti-CSRF tokens where required.
• If bearer tokens must be available to JavaScript, keep access tokens short-lived and in memory rather than persistent browser storage.
• Rotate refresh credentials, support server-side revocation, and narrowly scope token permissions and audience.
• Configure persistence plugins with an explicit allowlist containing only non-sensitive preferences such as theme or layout settings.
• Add tests or code-review checks that reject persistence configurations containing fields named token, accessToken, refreshToken, or equivalent credentials.
• Update the example to distinguish harmless UI preferences from authentication secrets.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description is entirely in Chinese and presents the skill's usage and behavior without any indication that language is optional or limited to a specific audience. This creates a natural-language locale policy concern because the skill effectively assumes a single language rather than offering user opt-in or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill content is written in Chinese, including headings, instructions, examples, and error strings, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language policy concern because it effectively enforces a specific language without user opt-in.

Content

No source excerpt is available for this finding.