Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Vue dashboard scaffold with normal project-copy and npm-install behavior, though users should update and review its frontend dependencies before using it with untrusted data.
Review and update npm dependencies, especially ECharts, before production use; change the registry or lockfile policy if registry.npmmirror.com is not appropriate; document or adapt the Chinese locale; avoid passing untrusted HTML-capable chart content without sanitization; and set Vite host binding explicitly if the dev server should not be reachable on the local network.
声明的核心用途是“创建/一键生成 Vue3 + TypeScript 数据大屏脚手架或页面”，而给出的代码块仅实现了“验证已有脚手架结果是否完整正确”的功能。其行为包括：检查必需文件是否存在、检查 package.json 中是否有指定依赖、解析 public/data 下 JSON 并校验字段结构。这属于辅助性的验收/审计脚本，而不是生成器本身，因此主目的明显不同。另一个细节偏差是描述中提到 Element Plus/Naive UI 组件库，但脚本硬编码检查的是 element-plus，并未体现 Naive UI。综合来看，描述未准确代表该代码块的实际行为，应判定为不匹配。
The document sets lang="zh-CN", which hard-codes a specific language/locale for the skill interface. Under the policy, locale-specific behavior should offer user choice or include a clear documented justification when it is not region-specific.
The lockfile pins Apache ECharts to version 5.6.0, which the supplied advisory identifies as affected by CVE-2026-45249, a cross-site scripting issue. In a Vue big-screen/dashboard scaffold, chart labels, tooltips, rich text, or remotely loaded JSON data may be rendered into charts, so an XSS flaw in the charting library can become reachable if untrusted or attacker-controlled data is displayed.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"preview": "vite preview"
},
"dependencies": {
"@element-plus/icons-vue": "^2.3.1",
"axios": "^1.7.9",
"echarts": "^5.6.0",
"echarts-liquidfill": "^3.1.0",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"dependencies": {
"@element-plus/icons-vue": "^2.3.1",
"axios": "^1.7.9",
"echarts": "^5.6.0",
"echarts-liquidfill": "^3.1.0",
"echarts-wordcloud": "^2.1.0",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"dependencies": {
"@element-plus/icons-vue": "^2.3.1",
"axios": "^1.7.9",
"echarts": "^5.6.0",
"echarts-liquidfill": "^3.1.0",
"echarts-wordcloud": "^2.1.0",
"element-plus": "^2.9.3",
The scaffold includes echarts 5.6.0, which is flagged with a known XSS advisory. In a dashboard-generation skill that renders charts from JSON or potentially user-controlled data, an XSS issue in the charting library is more relevant because untrusted labels, formatter content, or configuration data may be displayed in the browser and could lead to script execution in the dashboard context.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"@element-plus/icons-vue": "^2.3.1",
"axios": "^1.7.9",
"echarts": "^5.6.0",
"echarts-liquidfill": "^3.1.0",
"echarts-wordcloud": "^2.1.0",
"element-plus": "^2.9.3",
"pinia": "^2.3.0",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"axios": "^1.7.9",
"echarts": "^5.6.0",
"echarts-liquidfill": "^3.1.0",
"echarts-wordcloud": "^2.1.0",
"element-plus": "^2.9.3",
"pinia": "^2.3.0",
"vue": "^3.5.13",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"echarts": "^5.6.0",
"echarts-liquidfill": "^3.1.0",
"echarts-wordcloud": "^2.1.0",
"element-plus": "^2.9.3",
"pinia": "^2.3.0",
"vue": "^3.5.13",
"vue3-digital-flop": "^1.0.2"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"echarts-liquidfill": "^3.1.0",
"echarts-wordcloud": "^2.1.0",
"element-plus": "^2.9.3",
"pinia": "^2.3.0",
"vue": "^3.5.13",
"vue3-digital-flop": "^1.0.2"
},
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"echarts-wordcloud": "^2.1.0",
"element-plus": "^2.9.3",
"pinia": "^2.3.0",
"vue": "^3.5.13",
"vue3-digital-flop": "^1.0.2"
},
"devDependencies": {
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"element-plus": "^2.9.3",
"pinia": "^2.3.0",
"vue": "^3.5.13",
"vue3-digital-flop": "^1.0.2"
},
"devDependencies": {
"@types/node": "^22.10.0",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"vue3-digital-flop": "^1.0.2"
},
"devDependencies": {
"@types/node": "^22.10.0",
"@vitejs/plugin-vue": "^5.2.1",
"typescript": "~5.7.2",
"vite": "^6.0.7",
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"devDependencies": {
"@types/node": "^22.10.0",
"@vitejs/plugin-vue": "^5.2.1",
"typescript": "~5.7.2",
"vite": "^6.0.7",
"vue-tsc": "^2.2.0"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"@types/node": "^22.10.0",
"@vitejs/plugin-vue": "^5.2.1",
"typescript": "~5.7.2",
"vite": "^6.0.7",
"vue-tsc": "^2.2.0"
}
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"@vitejs/plugin-vue": "^5.2.1",
"typescript": "~5.7.2",
"vite": "^6.0.7",
"vue-tsc": "^2.2.0"
}
}
The JSON data uses Chinese-language strings for the unit and category labels ("万元", "线上", "线下", etc.), which imposes a specific language/locale in content consumed by the skill. There is no indication in this file of user opt-in, language selection, or a documented region-specific justification.
This JSON file contains user-facing labels entirely in Chinese (for example, the title and region names) with no indication that the skill is region-specific or that users can choose another language. The policy explicitly calls out language or locale constraints as a finding when they are imposed without opt-in or justification.
The component formats timestamps using the hardcoded 'zh-CN' locale in both initialization and refresh logic. This enforces a specific locale choice in user-facing output without offering a user preference or documenting a justified region-specific constraint.
The button label uses the Chinese text "全屏", which forces a specific language in the user-facing interface. There is no indication in this file that the language is configurable, optional, or justified as a region-specific skill.
The stylesheet hard-codes 'Microsoft YaHei' as the first-choice font, which reflects a specific language/locale preference. The file does not indicate that this locale choice is optional or limited to a documented region-specific use case.
SQP-3 applies to all file types and covers language or locale policy violations. This file presents its docstring, CLI help, and status/output text in Chinese only, which forces a specific language on users without any opt-in or justification that the skill is region-specific.