nuxt-extensions-core-vendoring
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill describes a standard development pattern (vendoring) for the
@lenne.tech/nuxt-extensionsmodule, facilitating better project comprehension and local patching. - [EXTERNAL_DOWNLOADS]: Documents the process of cloning code from the official
lenneTechGitHub repository (github.com/lenneTech/nuxt-extensions). This is a documented vendor resource and aligns with the skill's primary purpose. - [COMMAND_EXECUTION]: Describes the use of common development tools including
git,pnpm,oxfmt, and theghCLI for syncing changes and preparing pull requests. These operations are restricted to the intended developer workflow. - [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface where external code from the upstream repository is integrated into the local project. However, it mandates a human review process ("curation proposal to the human for review") and 3-way merge resolution for any conflicts, which serves as a security boundary. The data source is the vendor's own repository.
Audit Metadata