vue-expert-js
Fail
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: CRITICALMETADATA_POISONINGEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill metadata and documentation links identify the author as 'Jeffallan', which contradicts the system-provided author context of 'sodiqabdulwaris'. This inconsistency is a sign of deceptive metadata.
- [EXTERNAL_DOWNLOADS]: The skill includes external links to documentation hosted on
jeffallan.github.io. This domain and specific skill path have been explicitly blacklisted by security scanners as malicious. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and refactor user-provided JavaScript and JSDoc annotations, which serves as a vulnerability surface for indirect prompt injection.
- Ingestion points: The skill processes user-supplied Vue components, .mjs modules, and JSDoc blocks (SKILL.md).
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat user-provided code as untrusted data or to ignore embedded instructions.
- Capability inventory: The skill generates code, organizes project structures, and instructs the agent to execute shell commands like
eslintwith specific plugins (SKILL.md, references/testing-patterns.md). - Sanitization: No sanitization or validation logic is present to check the content of JSDoc tags or JavaScript logic before the agent incorporates it into the application structure.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata