Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed website-section cloning helper that calls an external API and may add generated component code, with no evidence of hidden persistence, credential theft, or destructive behavior.
Install this if you want an agent to use MiroMiro to recreate sections from live websites. Be aware it sends the target URL and options to an external service, consumes API credits, and may produce code or import files that should be reviewed for licensing, copied assets, and project fit before use.
The activation description is broad enough to trigger on many ordinary design or styling requests, including requests that may not require cloning a live site. That increases the chance the agent invokes an external website-to-code service unnecessarily, potentially sending user-provided URLs or causing reproduction of third-party site content without clear user intent or consent.
The instruction to choose a framework 'without asking' delegates a material implementation decision to the agent, which can cause it to modify project files or select an output format without explicit user confirmation. In this skill, that risk is amplified because the chosen mode may produce importable files for platforms like Shopify or Elementor and may also instruct adding CSS globally, increasing the chance of unintended changes.
For tailwind, jsx and vue, the `css` field may also carry the section's `@keyframes` — add
those to the project's global stylesheet or the animations silently do nothing.
If the repo you are working in already uses one of these, use it without asking. A user
who mentions WordPress, Elementor, Shopify or a theme wants the importable file, not a
component.
No suspicious patterns detected.