SkillSpector · vue-expert

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

references/mobile-hybrid.md

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

references/mobile-hybrid.md

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

references/mobile-hybrid.md

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

references/mobile-hybrid.md

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

references/mobile-hybrid.md

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

references/state-management.md

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/build-tooling.md

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

references/nuxt.md

Shadow Command Trigger: 'build optimization' conflicts with built-in command 'build'

SKILL.md