Skills/npm/softr-vibe-coding

softr-vibe-coding@2.25.0

VERIFIED· install only

Publisher claims: "Claude Code skill for generating production-ready Softr Vibe Coding blocks (JSX). Installs into ~/.claude/skills/ and auto-updates on each Claude Code session." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher leo-softr · publishing for 178 daysInstalls 2,463Last detonated 6 h ago
$claude mcp add softr-vibe-coding -- npx -y softr-vibe-coding
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

CRITICAL
HTML comment carrying imperative instructions to the agentreferences/modal-pages.md:128 · HTML comment carrying imperative instructions to the agentLIVE-CHECK: after one click on the button, run f=document.querySelector('[data-softr-dialog-type="OPEN_PAGE"] iframe'); [f.contentWindow.location.href, !!f.contFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Auto-update or dynamic fetch configurationcli/cli.js:124 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconsole.log(' and adds a SessionStart hook to auto-update on each Claude Code session.');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsREADME.md:56 · Collapsed <details> block carrying instructions<summary>Download the latest tarball</summary> ```bash mkdir -p ~/.claude/skills/softr-vibe-coding curl -L https://github.com/leo-softr/Softr-Vibe-Coding-Block-Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
HTML comment carrying imperative instructions to the agentSKILL.md:373 · HTML comment carrying imperative instructions to the agentLIVE-CHECK: drop "not yet run live" once the modal-pages.md live check has runFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
HTML comment carrying imperative instructions to the agentreferences/modal-pages.md:119 · HTML comment carrying imperative instructions to the agentLIVE-CHECK: on any staff page in the preview, run performance.getEntriesByType('resource').map(r=>r.name).filter(n=>n.includes('/blocks/navigation/')) and [...dFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
HTML comment carrying imperative instructions to the agentreferences/modal-pages.md:13 · HTML comment carrying imperative instructions to the agentLIVE-CHECK: after the live check in Softr <> HubSpot Demo, replace the sentence "Nothing here had been run in a live app when it was written" with the result, aFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
HTML comment carrying imperative instructions to the agentreferences/modal-pages.md:161 · HTML comment carrying imperative instructions to the agentLIVE-CHECK: in the parent run addEventListener('app:probe',e=>window.__got=e.detail); from the iframe run window.parent.dispatchEvent(new CustomEvent('app:probeFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Auto-update or dynamic fetch configurationpackage.json:4 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"description": "Claude Code skill for generating production-ready Softr Vibe Coding blocks (JSX). Installs into ~/.claude/skills/ and auto-updates on each Claude Code session.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagecli/cli.js:120 · npx invocation of non-well-known package — may execute untrusted codeconsole.log('Usage: npx ' + SKILL_NAME + '@latest <command>');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Rule modification attemptreferences/date-picker.md:284 · Rule modification attempt — overwriting existing instructions · informational: not an instruction filecalendar off at the card's edge. Same rule as Combo rule 1: no clipping class on anything thatFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagecli/cli.js:15 · npx invocation of non-well-known package — may execute untrusted codevar HOOK_COMMAND = 'npx -y --prefer-online ' + SKILL_NAME + '@latest sync';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:53 · npx invocation of non-well-known package — may execute untrusted code…arkdown to `./DESIGN.md` in the project root**), or the CLI fallback when not (`npx -y dembrandt@latest <url> --design-md --crawl 5`, then copy `output/<domain>/DESIG…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈25,039 tok
1 file · 46 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for softr-vibe-coding@2.25.0 as of 6 h ago. This is the package itself, not its dependencies.