The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute an external package ui-to-vue-converter@1.0.2 via npx or global npm install. This package is not from a known trusted organization or well-known service, posing a supply chain risk if the package contains malicious code.
Evidence: npx ui-to-vue-converter@1.0.2 --input ./screenshots --ui vant --output ./src and npm install -g ui-to-vue-converter@1.0.2.
[COMMAND_EXECUTION]: The skill provides shell commands that execute the downloaded package. While this is the primary purpose of the skill, it introduces the risk of running code from an unverifiable source with the user's local permissions.
Evidence: Use of npx and ui-to-vue binary commands in the CLI Usage section.
[CREDENTIALS_UNSAFE]: The skill discusses handling DASHSCOPE_API_KEY and suggests storing it in environment variables or local JSON configuration files. While it provides a .gitignore recommendation, the practice of instructing users to input or store API keys in potentially unencrypted local files or shell history is a security risk.
Evidence: export DASHSCOPE_API_KEY=your_key and the example .ui-to-vue.config.json configuration block.

ui-to-vue