npm - @cubis/foundry - Versions diffs - 0.3.83 → 0.3.84 - Mend

@cubis/foundry 0.3.83 → 0.3.84

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2880) hide show

package/workflows/workflows/agent-environment-setup/platforms/codex/skills/vibesec/references/dependency-audit.md DELETED Viewed

@@ -1,234 +0,0 @@
-# Dependency Audit Reference
-## Overview
-Dependency vulnerabilities are the most common real-world attack vector. This reference covers scanning tools, triage processes, and remediation strategies for every major ecosystem.
-## Scanning by Ecosystem
-### Node.js / npm
-```bash
-# Built-in audit
-npm audit --production           # Production deps only
-npm audit --audit-level=high     # Fail on high+ only
-# With detailed output
-npm audit --json | jq '.vulnerabilities | to_entries | .[] | {name: .key, severity: .value.severity, via: .value.via}'
-# Fix automatically (safe updates only)
-npm audit fix
-# Fix with breaking changes (review carefully)
-npm audit fix --force
-```
-**Override transitive dependencies:**
-```json
-// package.json
-{
-  "overrides": {
-    "vulnerable-package": ">=2.0.0"
-  }
-}
-```
-### Python
-```bash
-# pip-audit (recommended)
-pip-audit --strict --desc
-pip-audit -r requirements.txt
-# Safety (alternative)
-safety check --full-report -r requirements.txt
-# pip-audit with fix suggestions
-pip-audit --fix --dry-run
-```
-### Go
-```bash
-# govulncheck (official Go tool)
-govulncheck ./...
-# With verbose output showing affected functions
-govulncheck -show=verbose ./...
-```
-### Rust
-```bash
-# cargo-audit
-cargo audit
-# With fix suggestions
-cargo audit fix --dry-run
-```
-### Java / Maven
-```bash
-# OWASP Dependency-Check
-mvn org.owasp:dependency-check-maven:check
-# Gradle
-gradle dependencyCheckAnalyze
-```
-### Ruby
-```bash
-# bundler-audit
-bundle audit check --update
-# Fix
-bundle audit fix
-```
-### Multi-Language
-```bash
-# Trivy (covers most languages + containers)
-trivy fs .
-trivy fs --severity HIGH,CRITICAL .
-# Snyk
-snyk test
-snyk test --severity-threshold=high
-# Grype (Anchore)
-grype dir:.
-```
-## Triage Framework
-### Severity Assessment
-| CVSS Score | Severity | SLA |
-|-----------|----------|-----|
-| 9.0 - 10.0 | Critical | Fix within 24 hours |
-| 7.0 - 8.9 | High | Fix within 1 week |
-| 4.0 - 6.9 | Medium | Fix within 1 month |
-| 0.1 - 3.9 | Low | Next maintenance window |
-### Context-Based Adjustment
-| Context | Impact on Priority |
-|---------|-------------------|
-| Dependency is dev-only | Lower by 1 level (unless build-time RCE) |
-| Vulnerable function not called in your code | Lower by 1 level (document why) |
-| Network-reachable exploit but dep is client-only | Lower by 1 level |
-| Dependency processes user input | Raise or maintain level |
-| Application handles financial/health/PII data | Raise by 1 level |
-### Decision Matrix
-| Exploitable? | Patch Available? | Action |
-|-------------|-----------------|--------|
-| Yes | Yes | Update immediately |
-| Yes | No | Mitigate (WAF, input validation) or replace package |
-| No | Yes | Update at next opportunity |
-| No | No | Document, monitor, set reminder |
-## Maintenance Health Indicators
-| Indicator | Healthy | Concerning | Action Needed |
-|-----------|---------|-----------|---------------|
-| Last publish | < 6 months | 6-12 months | > 12 months |
-| Open issues/PRs | Actively managed | Growing backlog | Abandoned |
-| Maintainer count | 2+ active | 1 active | 0 active |
-| Download trend | Stable or growing | Declining | Rapidly declining |
-| Funding | Sponsored/corporate | Community only | No support |
-### Check Package Health
-```bash
-# npm: check package metadata
-npm view package-name time --json | jq 'to_entries | sort_by(.value) | last(3)'
-# Check for known malicious packages
-npx socket-security/cli report
-```
-## SBOM Generation
-Software Bill of Materials — required for compliance and supply chain security.
-```bash
-# CycloneDX for Node.js
-npx @cyclonedx/cyclonedx-npm --output-file sbom.json
-# CycloneDX for Python
-pip install cyclonedx-bom
-cyclonedx-py environment -o sbom.json
-# Syft (multi-language)
-syft dir:. -o cyclonedx-json > sbom.json
-# Trivy SBOM
-trivy fs . --format cyclonedx --output sbom.json
-```
-## CI/CD Integration
-### GitHub Actions
-```yaml
-name: Dependency Audit
-on:
-  push:
-    branches: [main]
-  pull_request:
-  schedule:
-    - cron: '0 8 * * 1'  # Weekly Monday 8 AM
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-      - run: npm ci
-      - run: npm audit --production --audit-level=high
-      - name: Trivy scan
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          severity: 'HIGH,CRITICAL'
-          exit-code: '1'
-```
-### Automated Dependency Updates
-| Tool | Ecosystem | Features |
-|------|-----------|----------|
-| Dependabot | Multi-language | GitHub-native, simple config, grouped updates |
-| Renovate | Multi-language | Highly configurable, auto-merge, scheduling |
-| Socket.dev | npm | Supply chain attack detection |
-```yaml
-# .github/dependabot.yml
-version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    groups:
-      production-deps:
-        dependency-type: "production"
-      dev-deps:
-        dependency-type: "development"
-    open-pull-requests-limit: 10
-```
-## Dependency Pinning Strategy
-| Environment | Strategy | Rationale |
-|------------|----------|-----------|
-| Application | Pin exact versions in lockfile | Reproducible builds |
-| Library | Use semver ranges | Allow consumers to update |
-| Docker base images | Pin digest (sha256) | Prevent supply chain attacks |
-| CI tool versions | Pin exact | Reproducible pipelines |

package/workflows/workflows/agent-environment-setup/platforms/codex/skills/vibesec/references/quick-checks.md DELETED Viewed

@@ -1,135 +0,0 @@
-# Quick Security Checks Reference
-## Overview
-A curated set of fast, high-signal security checks that can be run in minutes. These checks catch the most common and impactful security issues without the overhead of a full audit.
-## Secret Detection
-### Files to Check
-| File Pattern | What to Look For |
-|-------------|-----------------|
-| `.env`, `.env.*` | Committed secrets, database URLs, API keys |
-| `*.config`, `*.conf` | Hardcoded credentials, connection strings |
-| `docker-compose*.yml` | Passwords in environment sections |
-| `*.pem`, `*.key`, `*.p12` | Private keys committed to repo |
-| `.npmrc`, `.pypirc` | Package registry tokens |
-| `terraform.tfvars` | Cloud credentials |
-### Quick Scan Commands
-```bash
-# gitleaks (recommended — comprehensive)
-gitleaks detect --source . --verbose
-# trufflehog (git history scan)
-trufflehog git file://. --only-verified
-# Manual grep for common patterns
-grep -rn "password\s*=" --include="*.{js,ts,py,rb,go,java,env,yml,yaml}" .
-grep -rn "api[_-]key\s*=" --include="*.{js,ts,py,rb,go,java,env,yml,yaml}" .
-grep -rn "secret\s*=" --include="*.{js,ts,py,rb,go,java,env,yml,yaml}" .
-grep -rn "sk_live_\|sk_test_\|rk_live_" .
-grep -rn "AKIA[0-9A-Z]{16}" .  # AWS access key pattern
-```
-### Common Secret Patterns
-| Pattern | Service |
-|---------|---------|
-| `sk_live_*`, `sk_test_*` | Stripe |
-| `AKIA[0-9A-Z]{16}` | AWS Access Key |
-| `ghp_*`, `gho_*`, `ghu_*` | GitHub Token |
-| `xoxb-*`, `xoxp-*` | Slack Token |
-| `SG.*` (40+ chars) | SendGrid |
-| `key-*` (32+ hex chars) | Mailgun |
-| `-----BEGIN.*PRIVATE KEY-----` | Private keys |
-| `mongodb+srv://*:*@` | MongoDB connection string |
-| `postgres://*:*@` | PostgreSQL connection string |
-## Security Headers
-### Check with curl
-```bash
-# Fetch all security-relevant headers
-curl -sI https://target.com | grep -iE "^(strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy|x-xss-protection)"
-```
-### Expected Headers
-| Header | Expected Value | Missing Impact |
-|--------|---------------|---------------|
-| Strict-Transport-Security | `max-age=31536000; includeSubDomains` | Downgrade attacks |
-| Content-Security-Policy | Restrictive policy | XSS amplification |
-| X-Frame-Options | `DENY` or `SAMEORIGIN` | Clickjacking |
-| X-Content-Type-Options | `nosniff` | MIME sniffing attacks |
-| Referrer-Policy | `strict-origin-when-cross-origin` | Referer header leaks |
-| Permissions-Policy | Restrict camera, microphone, etc. | Feature abuse by embedded content |
-## TLS/SSL Quick Check
-```bash
-# Check TLS versions and ciphers
-nmap --script ssl-enum-ciphers -p 443 target.com
-# Quick check for common issues
-curl -sI -v https://target.com 2>&1 | grep "SSL connection"
-# Certificate expiry
-echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -dates
-```
-## Authentication Quick Checks
-| Check | How | Red Flag |
-|-------|-----|----------|
-| Default credentials | Try admin/admin, admin/password | Access granted |
-| Login rate limiting | Send 20 rapid login attempts | No blocking or CAPTCHA |
-| Session cookie flags | Inspect Set-Cookie header | Missing Secure, HttpOnly, SameSite |
-| Password policy | Try "123456" as new password | Accepted |
-| Session expiry | Check token TTL or cookie max-age | > 24 hours or no expiry |
-| MFA availability | Check account settings | No MFA option |
-## Debug and Admin Endpoint Check
-```bash
-# Common debug/admin endpoints to check
-endpoints=(
-  "/__debug__" "/debug" "/_debug"
-  "/actuator" "/actuator/env" "/actuator/health"
-  "/phpinfo.php" "/server-info" "/server-status"
-  "/admin" "/admin/" "/administrator"
-  "/graphql" "/.well-known/openid-configuration"
-  "/swagger-ui" "/api-docs" "/swagger.json"
-  "/wp-admin" "/wp-login.php"
-  "/.git/config" "/.env" "/robots.txt" "/sitemap.xml"
-)
-for ep in "${endpoints[@]}"; do
-  code=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com$ep")
-  if [ "$code" != "404" ] && [ "$code" != "403" ]; then
-    echo "[!] $ep returned HTTP $code"
-  fi
-done
-```
-## Docker / Container Quick Checks
-| Check | Command | Red Flag |
-|-------|---------|----------|
-| Running as root | `docker inspect --format '{{.Config.User}}' container` | Empty or "root" |
-| Privileged mode | `docker inspect --format '{{.HostConfig.Privileged}}' container` | true |
-| Exposed ports | `docker ps --format "{{.Ports}}"` | 0.0.0.0 bindings |
-| Base image age | `docker inspect --format '{{.Created}}' image` | > 90 days |
-| Secrets in env | `docker inspect --format '{{.Config.Env}}' container` | Password/key visible |
-## Vibe Rating Scale
-| Rating | Criteria | Action |
-|--------|----------|--------|
-| GREEN | No critical issues, minor improvements available | Ship with confidence |
-| YELLOW | Configuration gaps, stale dependencies, no showstoppers | Fix before next release |
-| ORANGE | Committed secrets, vulnerable deps, missing auth controls | Fix before deployment |
-| RED | Active security holes, critical misconfigurations, leaked credentials | Stop and remediate now |

package/workflows/workflows/agent-environment-setup/platforms/codex/skills/vuejs/SKILL.md DELETED Viewed

@@ -1,94 +0,0 @@
----
-name: vuejs
-description: "Use when building web applications with Vue 3.5+. Invoke for Composition API, script setup, Pinia state management, TypeScript integration, Vue Router, SSR with Nuxt, and reactivity patterns."
----
-# Vue 3.5+ Composition API
-Senior frontend engineer specializing in Vue 3.5+ Composition API patterns, Pinia state management, TypeScript integration, Vue Router, and SSR/SSG with Nuxt for scalable, type-safe web applications.
-## Purpose
-Provide authoritative guidance on building production Vue 3.5+ applications using the Composition API with `<script setup>`. This skill covers reactive state with `ref`/`reactive`/`computed`/`watch`, Pinia stores for shared state, full TypeScript integration, Vue Router with typed routes, SSR and SSG with Nuxt 3, and testing strategies with Vitest and Vue Test Utils.
-## When to Use
-- Creating Vue 3 components using `<script setup>` and Composition API
-- Managing application state with Pinia stores
-- Implementing type-safe props, emits, and slots with TypeScript
-- Building single-page or multi-page apps with Vue Router
-- Configuring SSR, SSG, or hybrid rendering with Nuxt 3
-- Migrating from Options API or Vue 2 to Composition API
-- Writing unit and integration tests for Vue components
-- Optimizing Vue apps for performance and bundle size
-## Instructions
-1. **Verify the Vue version and build toolchain** before writing any code, because Vue 3.5 introduced `defineModel`, `useTemplateRef`, and improved `reactive` destructuring that do not exist in earlier versions, and Vite-based setups differ from webpack.
-2. **Use `<script setup lang="ts">` for all Single File Components**, because `<script setup>` provides the most concise syntax, enables compile-time macro support (`defineProps`, `defineEmits`, `defineModel`), and produces the most efficient compiled output.
-3. **Declare props with `defineProps<T>()`** using a TypeScript generic interface instead of the runtime declaration, because generic props provide full type inference in the template, catch type errors at compile time, and eliminate the need for `PropType` casts.
-4. **Use `ref()` for primitives and `reactive()` for objects** as the default reactive state strategy, because `ref()` wraps values in a `.value` container that maintains reactivity through reassignment while `reactive()` provides direct property access for complex objects without `.value`.
-5. **Derive computed values with `computed()`** instead of methods or watchers, because `computed()` caches its result and only recomputes when dependencies change, preventing unnecessary recalculations on every re-render.
-6. **Use `watch` and `watchEffect` intentionally**: prefer `watchEffect` for side effects that should track all reactive dependencies automatically, and `watch` with explicit sources when you need the previous value, lazy execution, or fine-grained control over which dependencies trigger the callback.
-7. **Manage shared state with Pinia stores** using the Composition API syntax (`defineStore` with a setup function), because Pinia provides devtools integration, SSR support, TypeScript inference, and hot module replacement without the boilerplate of Vuex mutations.
-8. **Define two-way bound props with `defineModel()`** instead of the manual `modelValue` + `update:modelValue` pattern, because `defineModel()` generates the prop and emit pair automatically with full TypeScript support and reduces component API surface.
-9. **Access template refs with `useTemplateRef()`** instead of declaring a `ref` with a matching template `ref` attribute name, because `useTemplateRef()` provides explicit intent, supports generic typing, and avoids naming collisions between refs and reactive variables.
-10. **Structure routes with Vue Router using typed route definitions** and `definePageMeta` in Nuxt, because typed routes catch broken links and missing params at compile time rather than at runtime in production.
-11. **Implement route guards in composition functions** (`onBeforeRouteLeave`, `onBeforeRouteUpdate`) or in `router.beforeEach` for global auth checks, because guards run before navigation commits and provide a centralized authorization enforcement point.
-12. **Use `<Suspense>` with async setup for data-dependent components**, because `<Suspense>` displays a fallback while the component's async `setup()` resolves and prevents the component from rendering in an incomplete state.
-13. **Provide and inject dependencies with `provide`/`inject`** typed with `InjectionKey<T>`, because typed injection keys ensure consumers receive the correct type and `provide`/`inject` avoids prop drilling through intermediate components.
-14. **Write component tests with Vitest and `@vue/test-utils`** mounting components with `mount()` or `shallowMount()` and asserting on rendered output and emitted events, because isolated component tests verify behavior without browser dependencies and run in milliseconds.
-15. **Lazy-load route components with `defineAsyncComponent` or dynamic `import()` in router config**, because code-splitting per route reduces initial bundle size and improves Time to Interactive for applications with many pages.
-16. **Configure SSR with Nuxt 3 for SEO-critical pages** and use `routeRules` for per-route rendering strategies (SSR, SSG, SWR, ISR), because different pages have different latency and freshness requirements that a single rendering mode cannot satisfy.
-## Output Format
-When delivering Vue 3.5+ code:
-1. **Component files** -- `.vue` SFCs with `<script setup lang="ts">`, `<template>`, and `<style scoped>` blocks
-2. **Store files** -- Pinia stores in `stores/` directory using setup function syntax
-3. **Composable files** -- Reusable composition functions in `composables/use-*.ts`
-4. **Router config** -- `router/index.ts` with typed route definitions
-5. **Test files** -- `.test.ts` files co-located with components or in `__tests__/`
-6. **Brief rationale** -- One-sentence explanation for each architectural decision
-## References
-Load detailed guidance based on context:
-| Topic | Reference | Load When |
-|-------|-----------|-----------|
-| Reactivity | `references/reactivity.md` | ref, reactive, computed, watch, watchEffect, defineModel |
-| Pinia | `references/pinia.md` | Store setup, actions, getters, SSR hydration, testing stores |
-| TypeScript | `references/typescript.md` | Generic props, typed emits, slots, provide/inject, augmentation |
-| Router & Nuxt | `references/router-nuxt.md` | Vue Router guards, Nuxt 3 pages, route rules, middleware |
-| Testing | `references/testing.md` | Vitest, Vue Test Utils, component testing, Pinia mocking |
-## Codex Platform Notes
-- Codex supports native subagents via `.codex/agents/*.toml` files with `name`, `description`, and `developer_instructions`.
-- Each subagent TOML can specify `model` and `model_reasoning_effort` to optimize cost per task difficulty:
-  - Light tasks (exploration, docs): `model = "gpt-5.3-codex-spark"`, `model_reasoning_effort = "medium"`
-  - Heavy tasks (security audit, orchestration): `model = "gpt-5.4"`, `model_reasoning_effort = "high"`
-  - Standard tasks (implementation): inherit parent model (omit `model` field).
-- Built-in agents: `default`, `worker`, `explorer`. Custom agents extend these via TOML definitions.
-- Codex operates under network restrictions — skills should not assume outbound HTTP access.
-- Use `$ARGUMENTS` to access user-provided arguments when the skill is invoked.
-- All skill guidance executes within the sandbox; file I/O is confined to the workspace.
-- Skills are installed at `.agents/skills/<skill-id>/SKILL.md`. Workflow skills can also be compiled to `.agents/skills/<workflow-id>/SKILL.md` as `generatedSkills`.
-- Codex supports three autonomy levels: `suggest`, `auto-edit`, `full-auto`.
-- MCP skill tools are available when the Cubis Foundry MCP server is connected.

package/workflows/workflows/agent-environment-setup/platforms/codex/skills/vuejs/evals/assertions.md DELETED Viewed

@@ -1,51 +0,0 @@
-# Vue 3.5+ Composition API -- Eval Assertions
-## Eval 01: Composition API component with defineModel and Pinia
-This eval validates correct usage of Vue 3.5 `<script setup>`, `defineModel()`, TypeScript generic props, and Pinia store integration.
-### Assertions
-| # | Type | Target | Rationale |
-|---|------|--------|-----------|
-| 1 | contains | `defineModel` | Verifies the skill uses `defineModel()` for two-way binding. Introduced in Vue 3.4 and stable in 3.5, `defineModel()` replaces the verbose `modelValue` + `update:modelValue` pattern with a single macro call. |
-| 2 | contains | `defineProps` | Verifies the skill uses `defineProps` with TypeScript generics for type-safe props. Generic props provide full template inference and compile-time error checking without `PropType`. |
-| 3 | contains | `defineStore` | Verifies the skill uses Pinia's `defineStore` for shared state. Pinia is the official Vue state management library with devtools integration, SSR support, and TypeScript inference. |
-| 4 | contains | `computed(` | Verifies the skill uses `computed()` for derived values. Computed properties cache their results and only recompute when dependencies change, unlike methods which run on every render. |
-| 5 | contains | `<script setup` | Verifies the skill uses `<script setup>` syntax. This is the recommended and most performant way to write Composition API components in Vue 3.5+. |
-### What a passing response looks like
-A passing response creates:
-- A `SearchFilter.vue` SFC with `<script setup lang="ts">`
-- `defineModel<string>()` for the search text input two-way binding
-- `defineProps<{ categories: string[]; selectedCategory: string }>()` with TypeScript generics
-- A Pinia store using `defineStore('filter', () => { ... })` setup syntax with reactive state and actions
-- `computed()` for the filtered result count derived from store state
-- `defineEmits<{ search: [query: string] }>()` for the typed search event
----
-## Eval 02: Vue Router with Nuxt SSR and route middleware
-This eval validates correct implementation of a Nuxt 3 page with SSR data fetching, route middleware, and typed parameters.
-### Assertions
-| # | Type | Target | Rationale |
-|---|------|--------|-----------|
-| 1 | contains | `useFetch` | Verifies the skill uses Nuxt's `useFetch` for SSR-compatible data fetching. `useFetch` deduplicates requests between server and client and provides automatic payload serialization. |
-| 2 | contains | `definePageMeta` | Verifies the skill uses `definePageMeta` for route configuration. This Nuxt macro sets middleware, layout, and validation at the page level with compile-time extraction. |
-| 3 | pattern | `defineNuxtRouteMiddleware\|navigateTo\|middleware` | Verifies the skill implements route middleware for authentication. Middleware runs before navigation and provides a centralized auth enforcement point. |
-| 4 | pattern | `useRoute\|params\.id\|params\[` | Verifies the skill accesses typed route parameters. The product ID from the `[id]` dynamic segment must be read from route params for data fetching. |
-| 5 | contains | `<script setup` | Verifies the skill uses `<script setup>` consistent with Nuxt 3 conventions. All Nuxt 3 pages should use this syntax for optimal compilation and auto-imports. |
-### What a passing response looks like
-A passing response provides:
-- A `pages/products/[id].vue` page using `<script setup lang="ts">`
-- `useFetch('/api/products/' + id)` or equivalent for SSR data fetching
-- `definePageMeta({ middleware: 'auth' })` to assign the auth middleware
-- A `middleware/auth.ts` file using `defineNuxtRouteMiddleware` that checks authentication and calls `navigateTo('/login')` for unauthenticated users
-- `useRoute()` to access `params.id` with proper typing
-- Error handling with `<NuxtErrorBoundary>` or conditional rendering based on fetch error state

package/workflows/workflows/agent-environment-setup/platforms/codex/skills/vuejs/evals/evals.json DELETED Viewed

@@ -1,68 +0,0 @@
-[
-  {
-    "id": "vuejs-eval-01",
-    "name": "Composition API component with defineModel and Pinia",
-    "description": "Validate that the skill correctly guides creation of a Vue 3.5 component using script setup, defineModel for two-way binding, and Pinia for shared state.",
-    "prompt": "Create a Vue 3.5 SearchFilter component using <script setup lang=\"ts\"> that has a text input with two-way binding via defineModel(), a category dropdown using defineProps with TypeScript generics, and reads/writes filter state from a Pinia store using the Composition API setup syntax. Emit a 'search' event when the user submits. Include computed properties for the filtered result count.",
-    "assertions": [
-      {
-        "type": "contains",
-        "value": "defineModel",
-        "description": "Must use defineModel() for two-way binding instead of manual modelValue + update:modelValue pattern"
-      },
-      {
-        "type": "contains",
-        "value": "defineProps",
-        "description": "Must use defineProps with TypeScript generics for compile-time type-safe prop declarations"
-      },
-      {
-        "type": "contains",
-        "value": "defineStore",
-        "description": "Must use Pinia defineStore for shared filter state management with devtools support"
-      },
-      {
-        "type": "contains",
-        "value": "computed(",
-        "description": "Must use computed() for derived values like filtered result count to leverage caching"
-      },
-      {
-        "type": "contains",
-        "value": "<script setup",
-        "description": "Must use <script setup> syntax for the most concise and performant Composition API component"
-      }
-    ]
-  },
-  {
-    "id": "vuejs-eval-02",
-    "name": "Vue Router with Nuxt SSR and route middleware",
-    "description": "Validate that the skill correctly implements a Nuxt 3 page with SSR data fetching, route middleware for auth, and typed route parameters.",
-    "prompt": "Implement a Nuxt 3 product detail page at pages/products/[id].vue that fetches product data using useFetch with SSR, defines a route middleware that redirects unauthenticated users to /login, uses definePageMeta for route configuration, and includes proper TypeScript typing for the route params. Handle loading and error states with NuxtErrorBoundary.",
-    "assertions": [
-      {
-        "type": "contains",
-        "value": "useFetch",
-        "description": "Must use Nuxt's useFetch composable for SSR-compatible data fetching with automatic deduplication"
-      },
-      {
-        "type": "contains",
-        "value": "definePageMeta",
-        "description": "Must use definePageMeta to configure route metadata including middleware assignment"
-      },
-      {
-        "type": "pattern",
-        "value": "defineNuxtRouteMiddleware|navigateTo|middleware",
-        "description": "Must implement route middleware for authentication guard that redirects to login"
-      },
-      {
-        "type": "pattern",
-        "value": "useRoute|params\\.id|params\\[",
-        "description": "Must access typed route parameters for the product ID from the dynamic [id] segment"
-      },
-      {
-        "type": "contains",
-        "value": "<script setup",
-        "description": "Must use <script setup> syntax consistent with Nuxt 3 and Vue 3.5 conventions"
-      }
-    ]
-  }
-]