skills/helloggx/skill/vue-creater/Gen Agent Trust Hub

vue-creater

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts to automate terminal operations, executing commands via the subprocess module to manage directories and project files during the scaffolding process.\n- [EXTERNAL_DOWNLOADS]: Scripts configure the npm registry to use a well-known mirror (npmmirror.com) and utilize the bun package manager to fetch necessary dependencies for the generated projects.\n- [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code through standard project initialization tools like npm create vue@latest and npx shadcn-vue@latest, which is the intended behavior for bootstrapping modern frontend projects.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting design data from external URLs or local environment variables (Ingestion points: Step 2). There are no specific delimiters (Boundary markers: Absent) or sanitization logic (Sanitization: Absent) for this data before it is processed by secondary tools to modify the project filesystem (Capability inventory: get_token and script file-writing).
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 11:33 AM