nuxt-og-image
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical manual for a legitimate Nuxt module authored by the 'nuxt-modules' community. All instructions and features described align with the standard functionality of generating Open Graph images in a web framework environment.
- [EXTERNAL_DOWNLOADS]: Recommends installing well-known web development packages such as '@takumi-rs/core', 'satori', and 'playwright-core' from official registries. These downloads are necessary for the rendering engines used by the module and originate from recognized sources in the JavaScript ecosystem.
- [CREDENTIALS_SAFE]: Correctly identifies the need for a stable 'NUXT_APP_SECRET' to secure runtime URLs against tampering. It provides a dedicated command ('pnpm exec nuxt-og-image generate-secret') to help users manage this securely rather than hardcoding values, which is a significant security feature.
- [COMMAND_EXECUTION]: Includes standard development commands ('npx', 'pnpm') for module management and configuration. The operations are transparent, interactive in development environments, and typical for Nuxt-based project workflows.
- [INDIRECT_PROMPT_INJECTION]: While the module processes component props to render images, it implements security controls like URL signing and secret derivation to ensure the integrity of the data being processed by the server-side renderers, effectively mitigating unauthorized parameter manipulation.
Audit Metadata