non-ai-lp
Warn
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: In the file
references/vibe-coding.md, the skill recommends installing a global Node.js package nameduipro-cliusingnpm install -g. This package is not a widely recognized industry tool, and the documentation provides a generic, incomplete reference link (https://github.com/), making the provenance and safety of the dependency unverifiable. - [COMMAND_EXECUTION]: The skill instructs the agent or user to execute
uipro init --ai claudefollowing the package installation. Recommending the execution of unverified third-party CLI tools with global system privileges is a security risk. - [PROMPT_INJECTION]: The
descriptioninSKILL.mdcontains a strong directive ("必ずこのスキルを使うこと" - "Always use this skill") triggered by common keywords. This is an attempt to override the agent's natural skill selection or routing logic by mandating its own use for a broad category of web development tasks.
Audit Metadata