vitepress
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists entirely of reference documentation and implementation recipes for the VitePress framework. The provided files contain legitimate configuration examples and instructional content without any malicious behavior.
- [EXTERNAL_DOWNLOADS]: The documentation includes examples of fetching data from external API endpoints (e.g.,
api.example.com) and installing standard development dependencies likesass,less, andmarkdown-it-mathjax3. These are documented as part of the tool's standard data-loading and styling features. - [COMMAND_EXECUTION]: The skill provides a reference for the VitePress CLI, documenting standard commands for initialization, development, and production building (
vitepress dev,vitepress build, etc.). - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Processes Markdown content, local data files, and responses from external APIs during the site build process.
- Boundary markers: No specific security boundaries are defined; the skill follows the standard VitePress build pipeline.
- Capability inventory: Accesses the local file system (via Node.js
fs), performs network requests (viafetch), and executes site compilation via the CLI. - Sanitization: Content rendering is managed by the VitePress/Vue compiler, which is a standard behavior for this toolset. This represents a functional surface inherent to the tool's purpose.
Audit Metadata