vue-creater
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to automate terminal operations, executing commands via the subprocess module to manage directories and project files during the scaffolding process.\n- [EXTERNAL_DOWNLOADS]: Scripts configure the npm registry to use a well-known mirror (npmmirror.com) and utilize the bun package manager to fetch necessary dependencies for the generated projects.\n- [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code through standard project initialization tools like
npm create vue@latestandnpx shadcn-vue@latest, which is the intended behavior for bootstrapping modern frontend projects.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting design data from external URLs or local environment variables (Ingestion points: Step 2). There are no specific delimiters (Boundary markers: Absent) or sanitization logic (Sanitization: Absent) for this data before it is processed by secondary tools to modify the project filesystem (Capability inventory: get_token and script file-writing).
Audit Metadata