nuxt-code-editor
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: HIGHPROMPT_INJECTION
Full Analysis
- PROMPT_INJECTION (HIGH): The skill is highly vulnerable to indirect prompt injection because it facilitates automatic code modification based on natural language user input. Ingestion points: User-provided descriptions of features or bug fixes. Boundary markers: None; the skill does not specify delimiters to separate user data from instructions, allowing input to potentially override the agent's behavior. Capability inventory: Extensive write access to all .ts, .vue, and .scss files, including critical server-side API handlers and authentication logic (Better-Auth). Sanitization: None; the skill relies on the agent to follow 'standards' which can be bypassed to introduce security flaws like XSS or unauthorized data access.
- Metadata (LOW): The author is listed as 'GitHub Copilot,' which is likely a misleading claim to gain trust as it is a common name for automated tools rather than a specific verifiable author for this instruction set.
Recommendations
- AI detected serious security threats
Audit Metadata