vitepress-tutorial

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes pnpm install within a user-specified directory to initialize the documentation project. This is a standard operation for setting up the VitePress environment as described in the workflow.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs Node.js packages including vitepress, mermaid, and vitepress-plugin-mermaid from the official NPM registry. These are well-known packages necessary for the skill's stated purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data by reading and analyzing local source code to generate descriptive documentation.
  • Ingestion points: The Task and Explore tools are used to read arbitrary files within the target project directory during the Deep Analysis phase (SKILL.md).
  • Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from following directions potentially embedded in comments or strings within the analyzed source code.
  • Capability inventory: The skill has the ability to write files (Markdown documentation, configuration files), create directory structures, and execute shell commands (pnpm install).
  • Sanitization: There is no evidence of sanitization or filtering applied to the content extracted from source files before it is used to generate the VitePress site.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 04:53 PM