Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ainative Vue Sdk

v1.0.0

Use @ainative/vue-sdk to add AI chat to Vue 3 apps. Use when (1) Installing @ainative/vue-sdk, (2) Using the useChat composable in Vue components, (3) Provid...

0· 107·1 current·1 all-time
byToby Morning@urbantech

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for urbantech/ainative-vue-sdk.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ainative Vue Sdk" (urbantech/ainative-vue-sdk) from ClawHub.
Skill page: https://clawhub.ai/urbantech/ainative-vue-sdk
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ainative-vue-sdk

ClawHub CLI

Package manager switcher

npx clawhub@latest install ainative-vue-sdk
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the instructions: the document describes installing an @ainative/vue-sdk and using its Vue 3 composables (useChat, useCredits, provideAINative). That purpose is consistent with the content. However, the examples clearly expect an AINative API key (import.meta.env.VITE_AINATIVE_API_KEY / runtimeConfig public values) even though the skill metadata declares no required environment variables or primary credential.
Instruction Scope
The SKILL.md stays within scope: it shows npm install, import and usage examples, and references api.ainative.studio as the API endpoint. It does not instruct reading arbitrary system files or unrelated credentials. Minor scope issue: it directs the developer to place an API key in client-side env examples (VITE_ / public runtimeConfig) which has security implications and is not declared in the skill metadata.
Install Mechanism
There is no install spec in the skill bundle (instruction-only). The README recommends 'npm install @ainative/vue-sdk', which is a standard, low-risk package install path. No downloads from arbitrary URLs or archive extraction are present in the skill metadata.
!
Credentials
The SKILL.md demonstrates use of an AINative API key (VITE_AINATIVE_API_KEY / runtimeConfig.public.ainativeApiKey) to call https://api.ainative.studio, but the skill metadata lists no required environment variables or primary credential. The SDK legitimately needs an API key to function — the metadata omission is an inconsistency and a practical concern. There are no other unrelated credentials requested.
Persistence & Privilege
Flags show always: false and no special privileges. The skill is instruction-only and does not request persistent presence or system-wide configuration changes.
What to consider before installing
This skill's README looks like ordinary usage documentation for a Vue SDK, but be aware of two points before installing/using it: (1) The examples require an AINative API key and send chat data to https://api.ainative.studio — confirm you trust that service and its privacy practices. (2) The skill metadata does not declare the API key as a required env var; that mismatch could be an oversight. Do these steps before proceeding: verify the npm package @ainative/vue-sdk exists on the public registry and inspect its source (or GitHub repo/homepage) to ensure code matches the docs; don't embed secret keys in client-bundled public env values — prefer a server-side proxy or keep keys in server-only envs; review network endpoints the package calls; and only install if you trust the package owner and the API endpoint. If you want higher assurance, ask the publisher for a repository/homepage and audit the package contents.

Like a lobster shell, security has layers — review code before you run it.

latestvk9788kqjsftmkw4c2d271ra9ex83g894
107downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

@ainative/vue-sdk

Vue 3 composables for AINative chat completions.

Install

npm install @ainative/vue-sdk

Setup: provideAINative

// main.ts
import { createApp } from 'vue';
import { provideAINative } from '@ainative/vue-sdk';
import App from './App.vue';

const app = createApp(App);

app.provide('ainative', {
  apiKey: import.meta.env.VITE_AINATIVE_API_KEY,
  baseUrl: 'https://api.ainative.studio',
});

app.mount('#app');

Or provide inside a component:

<script setup>
import { provideAINative } from '@ainative/vue-sdk';
provideAINative({ apiKey: import.meta.env.VITE_AINATIVE_API_KEY });
</script>

useChat Composable

<!-- ChatComponent.vue -->
<script setup lang="ts">
import { ref } from 'vue';
import { useChat } from '@ainative/vue-sdk';
import type { Message } from '@ainative/vue-sdk';

const { messages, isLoading, error, sendMessage, reset } = useChat({
  model: 'claude-3-5-sonnet-20241022',
  initialMessages: [],
});

const input = ref('');

async function send() {
  if (!input.value.trim()) return;
  const newMessages: Message[] = [
    ...messages.value,
    { role: 'user', content: input.value }
  ];
  input.value = '';
  await sendMessage(newMessages);
}
</script>

<template>
  <div>
    <div v-for="(msg, i) in messages" :key="i" :class="['message', msg.role]">
      <strong>{{ msg.role }}:</strong> {{ msg.content }}
    </div>

    <div v-if="isLoading">Thinking...</div>
    <div v-if="error" class="error">Error: {{ error.message }}</div>

    <input
      v-model="input"
      @keydown.enter="send"
      placeholder="Type a message..."
    />
    <button @click="send" :disabled="isLoading">Send</button>
    <button @click="reset">Reset</button>
  </div>
</template>

useChat Options

OptionTypeDefaultDescription
modelstringModel ID (e.g. claude-3-5-sonnet-20241022)
initialMessagesMessage[][]Seed the conversation

useChat Return

FieldTypeDescription
messagesRef<Message[]>Reactive message list
isLoadingRef<boolean>True during request
errorRef<AINativeError | null>Last error
sendMessage(msgs: Message[]) => Promise<...>Send next turn
reset() => voidClear conversation

useCredits Composable

<script setup>
import { useCredits } from '@ainative/vue-sdk';
const { balance, isLoading, error, refetch } = useCredits();
</script>

<template>
  <div v-if="!isLoading">
    Credits: {{ balance?.remaining_credits }} | Plan: {{ balance?.plan }}
    <button @click="refetch">Refresh</button>
  </div>
</template>

Nuxt Integration

// plugins/ainative.client.ts
import { provideAINative } from '@ainative/vue-sdk';
export default defineNuxtPlugin(() => {
  provideAINative({ apiKey: useRuntimeConfig().public.ainativeApiKey });
});
// nuxt.config.ts
export default defineNuxtConfig({
  runtimeConfig: {
    public: { ainativeApiKey: process.env.VITE_AINATIVE_API_KEY }
  }
});

Exports

import {
  useChat,
  useCredits,
  useAINative,
  provideAINative,
  type Message,
  type UseChatOptions,
  type UseChatReturn,
  type AINativeError,
} from '@ainative/vue-sdk';

References

  • packages/sdks/vue/src/composables/useChat.ts — useChat implementation
  • packages/sdks/vue/src/composables/useCredits.ts — useCredits implementation
  • packages/sdks/vue/src/composables/useAINative.ts — Config injection
  • packages/sdks/vue/src/index.ts — Package exports

Comments

Loading comments...