use-vp-config
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@liangmi/vp-configpackage and uses thevite-plustoolchain. These are vendor-specific dependencies required for the skill's primary configuration tasks.\n- [COMMAND_EXECUTION]: The skill executes multiple shell commands using thevpCLI tool (Vite+), includingvp install,vp config,vp check, and various task execution commands viavp run.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection by ingesting untrusted project files.\n - Ingestion points: The agent is instructed to read
AGENTS.md,vite.config.ts, andpackage.jsonto inform its configuration decisions.\n - Boundary markers: There are no instructions to treat the content of these files as data only or to ignore potential instructions embedded within them.\n
- Capability inventory: The skill can execute shell commands (
vp) and modify project files, which could be abused if malicious instructions are found in the input files.\n - Sanitization: No sanitization or validation logic is defined for the content read from the project files.
Audit Metadata