vueuse-functions

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation suggests the installation of several well-known and trusted third-party libraries from the npm registry to support specific integrations. These include:
  • async-validator (for useAsyncValidator)
  • axios (for useAxios)
  • change-case (for useChangeCase)
  • universal-cookie (for useCookies)
  • drauu (for useDrauu)
  • focus-trap (for useFocusTrap)
  • fuse.js (for useFuse)
  • idb-keyval (for useIDBKeyval)
  • jwt-decode (for useJwt)
  • nprogress (for useNProgress)
  • qrcode (for useQRCode)
  • [INDIRECT_PROMPT_INJECTION]: The skill provides documentation for building features that ingest external or user-provided data. This represents a potential indirect prompt injection surface if the resulting applications process this data without adequate sanitization.
  • Ingestion points: Data enters the application context through composables like useFetch, useStorage, useClipboard, useUrlSearchParams, and useRouteQuery.
  • Boundary markers: The documentation uses standard JavaScript interpolation in examples (e.g., in references/computedAsync.md and references/useFetch.md) but does not explicitly enforce boundary markers for external content as it is a utility library guide.
  • Capability inventory: The skill guides the use of browser capabilities such as network requests (useFetch), persistent storage (useStorage), and clipboard access (useClipboard).
  • Sanitization: Sanitization is the responsibility of the application developer; the composables provide raw access to the underlying browser APIs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 04:20 PM