use-vp-config

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @liangmi/vp-config package and uses the vite-plus toolchain. These are vendor-specific dependencies required for the skill's primary configuration tasks.\n- [COMMAND_EXECUTION]: The skill executes multiple shell commands using the vp CLI tool (Vite+), including vp install, vp config, vp check, and various task execution commands via vp run.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection by ingesting untrusted project files.\n
  • Ingestion points: The agent is instructed to read AGENTS.md, vite.config.ts, and package.json to inform its configuration decisions.\n
  • Boundary markers: There are no instructions to treat the content of these files as data only or to ignore potential instructions embedded within them.\n
  • Capability inventory: The skill can execute shell commands (vp) and modify project files, which could be abused if malicious instructions are found in the input files.\n
  • Sanitization: No sanitization or validation logic is defined for the content read from the project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 10:11 AM