vite-plus-best-practices
Fail
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends installing the 'vp' tool using shell pipe patterns: 'curl -fsSL https://vite.plus | bash' for macOS/Linux and 'irm https://vite.plus/ps1 | iex' for Windows. These methods execute unverified remote code directly in the host environment.
- [REMOTE_CODE_EXECUTION]: The skill documents the 'vpx' and 'vp dlx' commands, which are designed to download and execute remote packages from registries or Git repositories, allowing for the execution of third-party code.
- [COMMAND_EXECUTION]: The core functionality of the Vite+ tool involves executing various CLI commands for development, building, and testing, as well as running arbitrary user-defined tasks and scripts via the 'vp run' command.
- [EXTERNAL_DOWNLOADS]: The tool includes automated management of Node.js runtimes and other toolchain components, fetching binaries from remote mirrors or official distributions as needed. It also mentions an unsigned Windows installer ('vp-setup.exe') hosted on 'setup.viteplus.dev'.
Recommendations
- HIGH: Downloads and executes remote code from: https://vite.plus - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata