vite
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a technical reference for the Vite build tool and its ecosystem (Rolldown, Oxc, Nitro). All documented CLI commands, configuration patterns, and API usage examples are consistent with official Vite documentation and industry standards for frontend build tooling.
- [INDIRECT_PROMPT_INJECTION]: The skill documents an attack surface where the build tool processes untrusted project files and environment data.
- Ingestion points: User-provided configuration files (
vite.config.ts), environment variable files (.env), and source files matching glob patterns (import.meta.glob). - Boundary markers: Standard file system boundaries; the documentation correctly highlights that only
VITE_prefixed variables are exposed to the client context, providing a layer of isolation for secrets. - Capability inventory: The skill describes capabilities including build execution (
vite build), dev server middleware configuration, and the ability to load all system environment variables vialoadEnvif configured by the user. - Sanitization: The documentation explicitly teaches the best practice of using prefixes to prevent accidental data exposure and emphasizes using modern ESM patterns over CommonJS.
Audit Metadata