quasar-skilld
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Quasar framework packages, including
quasar,@quasar/extras, and@quasar/vite-plugin, from the standard NPM registry. - [COMMAND_EXECUTION]: The documentation includes example commands for the agent to use locally, such as using
ripgrepto search documentation andpython3to parse local JSON API descriptors. - [DYNAMIC_EXECUTION]: Provides examples of
python3one-liners intended to extract specific properties from local JSON files, which is a standard method for processing structured documentation in a development environment. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests and processes untrusted data from a project's
node_modulesdirectory. - Ingestion points: Files located in
node_modules/quasar/dist/api/*.jsonandnode_modules/quasar/dist/mcp/*.md(documented inreferences/offline-docs.md). - Boundary markers: The skill explicitly identifies the bundled JSON files as the "ground truth" to prevent hallucination or reliance on external, potentially poisoned data.
- Capability inventory: The skill uses
ripgrepfor text search andpython3for JSON parsing (documented inreferences/offline-docs.md). - Sanitization: No specific sanitization is applied to the documentation content, but the skill relies on the integrity of the installed npm package.
Audit Metadata