Skills/ClawHub/scaffold-nuxt-cloudflare-app-skill

scaffold-nuxt-cloudflare-app-skill@1.0.0

VERIFIED· install only

Publisher claims: "An agent skill that scaffolds a new, production-oriented full-stack app on the latest version of Nuxt, deployed to Cloudflare Workers via Wrangler — from natural language descriptions like "build me a blog on Cloudflare"." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher techvoyage51 · publishing for 81 daysInstalls 376Last detonated 6d ago
$clawhub install scaffold-nuxt-cloudflare-app-skill
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsSKILL.md:252 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- [ ] `.env.example` documents every required runtime env var (at minimum `NUXT_PUBLIC_SITE_URL` if OG image generation needs it at build time).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:144 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Root config: `nuxt.config.ts`, `wrangler.jsonc`, `eslint.config.mjs`, `tsconfig.json` (references-only, pointing at `.nuxt/tsconfig.*.json`), `.nuxtrc`, `.env.example`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:115 · npx invocation of non-well-known package — may execute untrusted code…odule**, `@antdv-next/nuxt` (requires Nuxt ≥ 4.0.0, Vue ≥ 3.5.0): 1. Install: `npx nuxi module add @antdv-next/nuxt` (or manually: `pnpm add -D @antdv-next/nuxt antdv-…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionSKILL.md:248 · File type combined with upload action — agent may exfiltrate local data files- `package.json` scripts: `dev`, `build`, `preview`, `postinstall: nuxt prepare`, `lint`, `lint:fix`, `typecheck: nuxt typecheck`, `test: vitest run`.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageSKILL.md:178 · npx invocation of non-well-known package — may execute untrusted codenpx wrangler deployFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:163 · npx invocation of non-well-known package — may execute untrusted code… and deploys the app to Cloudflare Workers, configured via `wrangler.jsonc`. **`npx nuxthub deploy` and NuxtHub Admin are deprecated as of NuxtHub v0.10** (Admin sunsets 2…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:152 · npx invocation of non-well-known package — may execute untrusted code…grationsDuringBuild: false` is deliberate: migrations run as an explicit step (`npx nuxt db migrate`, §9), not silently during every build. This minimal shape assumes b…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:172 · npx invocation of non-well-known package — may execute untrusted code4. `migrations_dir: "server/db/migrations/sqlite"` must match wherever migrations are emitted (see §9 — via `npx nuxt db generate`, not raw `drizzle-kit`).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈6,076 tok
1 file · 8 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.