vite-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill references standard Vite CLI commands such as 'vite' and 'vite build', as well as package manager commands like 'pnpm add' for project setup and build processes.
- [EXTERNAL_DOWNLOADS]: The documentation mentions installing official or community-supported packages such as 'vite@8', 'rolldown-vite', and various Vite plugins. These are standard dependencies within the Vite ecosystem.
- [INDIRECT_PROMPT_INJECTION]: As a developer tool guide, the skill describes processes that ingest untrusted data like source files and HTML templates and perform file system operations or run local servers.
- Ingestion points: Source files in the project root, including 'index.html' and '.ts' files processed via 'ssrLoadModule' or 'transformIndexHtml' in 'references/build-and-ssr.md'.
- Capability inventory: Local file system access (read/write), local network server hosting, and code transformation capabilities via the Vite API.
- Boundary markers: Not explicitly defined in the architectural examples, which is standard for this type of documentation.
- Sanitization: Relies on the underlying Vite and Rolldown toolchains to handle module resolution and asset transformation safely.
Audit Metadata