📦

pinia

Name: pinia
Author: antfu

v2026.1.28 Content revision r2 Medium Risk ⚙️ External commands📁 Filesystem access🔑 Env variables🌐 Network access

Build Reliable Pinia Stores for Vue Applications

Vue state patterns can become inconsistent and difficult to test. This skill provides proven Pinia guidance for stores, plugins, SSR, Nuxt, HMR, and testing.

Supports: Claude Codex Code(CC)

📊 70 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "pinia" from https://skillstore.io/skills/antfu-pinia.md and its manifest at https://skillstore.io/api/skills/antfu-pinia/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/antfu-pinia.md Signed manifest GET /api/skills/antfu-pinia/manifest Signed lockfile GET /api/skills/antfu-pinia/lockfile

Test it

Using "pinia". Create a typed cart store with totals, asynchronous checkout, and reactive component usage.

Expected outcome:

A Setup Store plan with typed cart items, status, and error state.
Computed totals and item counts derived from store state.
Bound checkout actions with clear loading and failure behavior.
Reactive component access through storeToRefs.

Using "pinia". Review a Nuxt store that is created once at module scope and hydrated with unsafe serialization.

Expected outcome:

A request-isolation warning for the module-scoped store.
A recommendation to create fresh Pinia state for each server request.
A safe serialization and hydration sequence.
A checklist for verifying server and client behavior.

Using "pinia". Plan tests for a component that uses actions from a plugin-enabled store.

Expected outcome:

A fresh testing instance for every test.
Plugin registration through the testing configuration.
Explicit action stubbing decisions and typed spy guidance.
Assertions for rendered state, calls, and failure paths.

Security Audit

Medium Risk

v5 • 7/23/2026 Open versioned report

All 22 static findings are false positives caused by TypeScript template strings, relative imports, ordinary identifiers, metadata links, and development environment checks. One semantic concern remains: an action subscription example logs unredacted arguments and errors that may contain passwords, tokens, or personal data.

Files scanned

1,543

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

references/core-stores.md:280-282 references/core-stores.md:320-330

Unredacted Action Arguments in Logs

The action subscription example logs every argument and full errors. Actions can receive passwords or tokens, so production code could expose secrets in logs.

The file shows password-bearing actions and unredacted action-argument logging, although the examples do not connect them directly.

Risk Factors

⚙️ External commands (9)

references/advanced-nuxt.md:106-114 references/core-stores.md:323-326 references/core-stores.md:326-330 references/core-stores.md:330-336 references/features-composing-stores.md:55-64 references/features-composing-stores.md:77-81 references/features-plugins.md:190-198 SKILL.md:55 SKILL.md:59

📁 Filesystem access (4)

references/best-practices-testing.md:14 references/best-practices-testing.md:35 references/best-practices-testing.md:172 references/core-stores.md:350

🔑 Env variables (2)

references/features-plugins.md:56 references/features-plugins.md:56

🌐 Network access (1)

SKILL.md:7

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/antfu-pinia/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/antfu-pinia/security.svg)](https://skillstore.io/skills/antfu-pinia?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/antfu-pinia?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/antfu-pinia/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/antfu-pinia.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

antfu. (2026). pinia security audit report (audit version 5) [Author version 2026.1.28]. Skillstore. https://skillstore.io/skills/antfu-pinia/audits/5

BibTeX citation

@techreport{antfu-antfu-pinia-2026,
  author = {antfu},
  title = {pinia security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/antfu-pinia/audits/5},
  note = {Author version 2026.1.28}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pinia security audit report (audit version 5)"
version: "2026.1.28"
type: report
authors:
  - name: "antfu"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/antfu-pinia/audits/5"
identifiers:
  - type: other
    value: "skillstore:antfu-pinia:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a typed feature store

Plan state, getters, actions, and reactive consumption for a new Vue feature.

Build focused Pinia tests

Choose store isolation, action stubbing, plugin setup, spies, and assertions for reliable tests.

Review Nuxt state architecture

Check store timing, request isolation, hydration, plugins, and HMR across a server-rendered application.

Try These Prompts

Create a basic store

Create a Pinia Setup Store for [feature]. Include typed state, computed getters, actions, and a brief explanation of each design choice.

Refactor reactive store usage

Refactor this Vue store usage to preserve reactivity with storeToRefs and bound actions: [details]. Explain each change and identify likely mistakes.

Design a testing strategy

Create a Pinia testing strategy for [component or store]. Cover fresh instances, plugin setup, action stubbing, typed mocks, and key assertions.

Architect Pinia for Nuxt SSR

Design a Pinia architecture for [Nuxt application]. Address store composition, request isolation, safe hydration, plugins, HMR, and testing. State all assumptions.

Best Practices

Use Setup Stores for complex composables and watchers, while keeping returned state and actions explicit.
Use storeToRefs when destructuring state or getters, and destructure bound actions directly.
Create fresh Pinia instances for tests and server requests to prevent shared state.

Avoid

Do not read mutually dependent stores during both store setup functions.
Do not create request-sensitive stores at module scope in server-rendered applications.
Do not copy reference examples without adapting types, plugins, error handling, and security controls.