The Agent Skills Directory

[METADATA_POISONING]: The skill metadata and documentation link to a blacklisted URL: https://jeffallan.github.io/claude-skills/skills/frontend/vue-expert/. Security scanners have flagged this domain for malicious activity.
[METADATA_POISONING]: The main skill definition file SKILL.md has a confirmed negative reputation (FileRepMalware) from automated security scanners.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a wide range of external dependencies from NPM and Capacitor registries, including framework plugins and native mobile integrations. Given the malicious reputation of the skill's own metadata, these external downloads pose a supply chain risk.
[COMMAND_EXECUTION]: The core workflow requires executing shell commands such as vue-tsc, npm run build, and Capacitor CLI operations (npx cap sync), which provide a mechanism for local code execution based on configurations influenced by the skill.
[INDIRECT_PROMPT_INJECTION]: The skill describes patterns for Nuxt 3 applications that fetch data from server-side API endpoints and render them in the client.
Ingestion points: Data fetched via useFetch and useAsyncData in references/nuxt.md and pages/users/[id].vue.
Boundary markers: None identified; there are no instructions to use delimiters or ignore embedded instructions in API responses.
Capability inventory: Subprocess execution for build and check tools (npm, npx, vue-tsc) as listed in the SKILL.md core workflow.
Sanitization: No explicit sanitization or validation of data from API responses is included in the implementation guidance.

vue-expert