use-vp-config
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@liangmi/vp-configpackage from the NPM registry via thevp installcommand. This package is an official resource from the skill author and is necessary for the skill's stated purpose of project configuration. - [COMMAND_EXECUTION]: The skill makes extensive use of the
vp(Vite+) CLI tool to perform project tasks such as installation (vp install), configuration (vp config), linting (vp check), and running tasks (vp run). These commands are standard for the development workflow described. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it reads and processes untrusted data from the repository being configured.
- Ingestion points: The agent is instructed to read
AGENTS.md,vite.config.ts, andpackage.jsonfrom the local project directory. - Boundary markers: None. The skill does not define specific delimiters or instructions to ignore potential commands embedded in these files.
- Capability inventory: The skill has the capability to execute shell commands (via
vp) and modify project source code. - Sanitization: There is no mention of sanitizing or validating the contents of the ingested configuration files before the agent acts on them.
Audit Metadata