vitest
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates as an attack surface by ingesting and executing code from external project files. Ingestion points: Test files and source code matched by glob patterns in vitest.config.ts. Boundary markers: None; the framework is designed to execute the ingested content as trusted code. Capability inventory: The framework supports shell command execution (via CLI), file system writes (reports, snapshots), and potential network operations. Sanitization: None; standard for a development tool designed to run arbitrary test code.
- [COMMAND_EXECUTION]: The instructions involve running the vitest CLI for various operations such as vitest run, vitest bench, and vitest typecheck.
- [DYNAMIC_EXECUTION]: The framework dynamically loads test files, configuration modules, and setup scripts during runtime execution.
Audit Metadata