Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a plugin UI installation helper, but its install and trigger instructions are too vague for the command and file-writing authority it requests.
Review this before installing. It does not show malicious behavior, but you should only use it if you are comfortable letting an agent modify a plugin-enabled project, and you should require the agent to show the exact files and commands before running any installation steps.
Allowing invocation from unspecified natural-language instructions creates an overly broad trigger surface for a skill that has exec/write capabilities. In agent environments, vague triggering increases the chance that unrelated prompts, prompt injection, or ambiguous user requests could cause the skill to perform installation or modification actions without sufficiently clear authorization.
The trigger section is incomplete and ambiguous, which is dangerous because this skill is designed to drive installation and command execution. Missing or malformed trigger rules reduce predictability and make it easier for an agent to activate the skill in the wrong context, potentially causing unintended filesystem or shell actions.
The skill instructs the agent to read installation instructions and execute them, yet it does not provide a clear user-facing warning that this may change the local system, modify files, or run commands. In a skill with read/exec/write tools, this omission materially raises the risk of unauthorized or under-informed system changes, especially if downstream installation instructions are unsafe or tampered with.
The skill asserts it is purely local and does not involve external API calls, but other sections introduce a callback URL parameter, an LLM API dependency, and network troubleshooting guidance. This inconsistency can mislead users and agents about data flow and trust boundaries, increasing the risk of unintended network exposure or transmission of sensitive project data.
At L233 the FAQ says the free version supports registering views only during plugin load, with dynamic add/remove handled by PRO functionality. But L236 says components are registered via api.getComponent(id), which is inconsistent with the stated registration model and suggests either an incorrect API name or contradictory guidance about how rendering integration works.
