vite-expert
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs project discovery and diagnostics using standard CLI tools such as
vite,npm,find,grep, andlsofto inspect dependencies and configuration files. - [COMMAND_EXECUTION]: It validates project setups by executing the existing build pipeline through
npm run buildorvite build, which is necessary for its primary function as a build optimizer. - [COMMAND_EXECUTION]: The diagnostic playbook includes generating a temporary file (
vite.config.minimal.js) and running a test build with it to troubleshoot plugin conflicts. - [DATA_EXFILTRATION]: The skill inspects environment variables using
env | grep VITE_. This is standard practice in the Vite ecosystem to identify public variables intended for the client and does not involve transmitting data to external destinations. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes untrusted project data. Analysis of this surface follows:
- Ingestion points: Reads
package.json,vite.config.*, and application source files in thesrc/directory. - Boundary markers: None explicitly implemented for script execution.
- Capability inventory: Can execute shell commands (
npm,vite,grep,find) and perform file-system writes (echo). - Sanitization: No specific content sanitization or escaping of project data was detected before processing.
Audit Metadata