quasar-skilld

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official Quasar framework packages, including quasar, @quasar/extras, and @quasar/vite-plugin, from the standard NPM registry.
  • [COMMAND_EXECUTION]: The documentation includes example commands for the agent to use locally, such as using ripgrep to search documentation and python3 to parse local JSON API descriptors.
  • [DYNAMIC_EXECUTION]: Provides examples of python3 one-liners intended to extract specific properties from local JSON files, which is a standard method for processing structured documentation in a development environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests and processes untrusted data from a project's node_modules directory.
  • Ingestion points: Files located in node_modules/quasar/dist/api/*.json and node_modules/quasar/dist/mcp/*.md (documented in references/offline-docs.md).
  • Boundary markers: The skill explicitly identifies the bundled JSON files as the "ground truth" to prevent hallucination or reliance on external, potentially poisoned data.
  • Capability inventory: The skill uses ripgrep for text search and python3 for JSON parsing (documented in references/offline-docs.md).
  • Sanitization: No specific sanitization is applied to the documentation content, but the skill relies on the integrity of the installed npm package.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 07:46 AM