Security audit
Security checks for vulnerabilities and agentic risk
This Vue component generator is mostly plain documentation, but it asks for shell execution and write access with broad, poorly scoped instructions.
Review this before installing if you do not want a component-generation skill to have shell execution authority. It appears to be plain Markdown with no bundled payload, but its exec permission and broad scope should be tightened or used only in a trusted workspace.
The activation language includes very broad development scenarios such as code generation, programming assistance, debugging, testing, and deployment. Overly broad triggers increase the chance the agent invokes this skill in unrelated contexts, which is especially risky because the manifest also grants write and exec capabilities.
A Vue component template generator should typically only need text generation and optional file writing, not shell execution. Granting exec creates unnecessary command-execution capability that could be abused by prompt injection, mis-triggering, or future skill changes to run arbitrary local commands on the host.
The skill is presented as a Vue component generator, but its capability description expands into generic create/query/modify/delete/import/export operations driven by abstract parameters. This kind of scope inflation makes the skill ambiguous, easier to misapply, and harder to secure because it suggests broader state-changing behaviors than users would expect from a code template tool.
The capability coverage section enumerates a wide range of keywords and fragments as activation hints without meaningful boundaries. This broad keyword-matching approach can cause accidental or adversarial activation, pulling in a skill with unnecessary privileges during general developer workflows.
The skill claims component generation is fully local and does not involve external APIs, yet it requests exec capability and explicitly suggests running network diagnostics like ping. This mismatch weakens operator trust and expands the possible behavior surface beyond what users would reasonably expect from a markdown-driven Vue template generator.
No suspicious patterns detected.
