vueuse-functions
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation suggests the installation of several well-known and trusted third-party libraries from the npm registry to support specific integrations. These include:
async-validator(foruseAsyncValidator)axios(foruseAxios)change-case(foruseChangeCase)universal-cookie(foruseCookies)drauu(foruseDrauu)focus-trap(foruseFocusTrap)fuse.js(foruseFuse)idb-keyval(foruseIDBKeyval)jwt-decode(foruseJwt)nprogress(foruseNProgress)qrcode(foruseQRCode)- [INDIRECT_PROMPT_INJECTION]: The skill provides documentation for building features that ingest external or user-provided data. This represents a potential indirect prompt injection surface if the resulting applications process this data without adequate sanitization.
- Ingestion points: Data enters the application context through composables like
useFetch,useStorage,useClipboard,useUrlSearchParams, anduseRouteQuery. - Boundary markers: The documentation uses standard JavaScript interpolation in examples (e.g., in
references/computedAsync.mdandreferences/useFetch.md) but does not explicitly enforce boundary markers for external content as it is a utility library guide. - Capability inventory: The skill guides the use of browser capabilities such as network requests (
useFetch), persistent storage (useStorage), and clipboard access (useClipboard). - Sanitization: Sanitization is the responsibility of the application developer; the composables provide raw access to the underlying browser APIs.
Audit Metadata