vite-expert

Pass

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs project discovery and diagnostics using standard CLI tools such as vite, npm, find, grep, and lsof to inspect dependencies and configuration files.
  • [COMMAND_EXECUTION]: It validates project setups by executing the existing build pipeline through npm run build or vite build, which is necessary for its primary function as a build optimizer.
  • [COMMAND_EXECUTION]: The diagnostic playbook includes generating a temporary file (vite.config.minimal.js) and running a test build with it to troubleshoot plugin conflicts.
  • [DATA_EXFILTRATION]: The skill inspects environment variables using env | grep VITE_. This is standard practice in the Vite ecosystem to identify public variables intended for the client and does not involve transmitting data to external destinations.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes untrusted project data. Analysis of this surface follows:
  • Ingestion points: Reads package.json, vite.config.*, and application source files in the src/ directory.
  • Boundary markers: None explicitly implemented for script execution.
  • Capability inventory: Can execute shell commands (npm, vite, grep, find) and perform file-system writes (echo).
  • Sanitization: No specific content sanitization or escaping of project data was detected before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 17, 2026, 02:08 AM
Security Audit — agent-trust-hub — vite-expert