Security audit
Security checks for vulnerabilities and agentic risk
This is a Vue 3 coding-help skill with broad write and command permissions, but I found no hidden payloads, persistence, data theft, or destructive behavior.
Install this only if you are comfortable with a Vue coding assistant that can read and edit project files and run local commands when invoked. Review command suggestions such as npm installs, project creation, deployment steps, and ping diagnostics before allowing them to run.
The invocation description is broad enough to match common development, debugging, and deployment requests, which may cause the agent to route unrelated or higher-risk tasks into a skill with write and exec access. Over-broad triggering increases the likelihood of the skill being selected in situations where its permissions are disproportionate to the user's actual need.
The skill is presented as a Vue 3 guidance/snippet toolbox, yet it declares exec capability and later suggests network diagnostics that are unnecessary for most documentation or code-advice tasks. This expands the attack surface by allowing command execution in contexts where users would reasonably expect only read-only coding assistance, increasing the risk of unintended system or network actions.
The skill exposes write and exec capabilities without clear, prominent warnings that these actions can modify the filesystem or execute commands on the host. Users may trust the skill as a simple Vue coding assistant and not realize it can perform system-affecting operations, which undermines informed consent and safe tool use.
The documented capabilities broaden from Vue best-practice guidance into generic create/query/export/modify/import/save operations with parameterized execution flows. That mismatch can let the skill be invoked for loosely related operational tasks beyond its advertised purpose, creating room for unintended file handling or workflow abuse under the cover of a harmless coding helper.
The capability keywords include vague trigger terms such as code generation, tooling, developer, and agent-oriented phrases that lack clear constraints. In combination with write/exec permissions, this broadens routing and can cause accidental activation for tasks outside the intended safe scope, increasing the chance of inappropriate file or command actions.
At L241-L243, the skill states it is Markdown-based and requires no additional API key unless an external API is explicitly noted. However, the error-handling section at L256 instructs the agent to run network connectivity checks (ping) and troubleshoot firewall/proxy issues, which introduces operational network behavior not explicitly identified in the earlier documentation. This is a documentation-level contradiction about what external/system interactions the skill may involve.
