vue-component-generator

SUSPICIOUS. The content itself looks benign and documentation-like, with no direct exfiltration or credential handling, but its actual footprint is weakly specified and over-permissioned: unrestricted Bash access is not well-justified for a generic Vue component generator skill, and the observed npx-based skill installation adds transitive trust. Risk is driven by broad execution scope and install trust ambiguity rather than confirmed malicious behavior.