vite
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system commands and project-local binaries to verify the development environment and perform builds.
- The
scripts/vite-doctorscript usessubprocess.runto executenode,npm,pnpm,yarn,bun, and the localviteexecutable with the--versionflag to capture toolchain metadata. - Operating instructions in
SKILL.mdandreferences/build-and-deploy.mdguide the agent to use standard, project-defined package manager scripts for production builds and previews. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-controlled metadata and configuration files, representing a surface for potential indirect injection.
- Ingestion points: The
scripts/vite-doctorscript readspackage.jsoncontent and performs directory iteration on the project root to identify config and environment files. - Boundary markers: The diagnostic tool produces structured JSON output to provide a clear boundary between ingested project data and agent instructions.
- Capability inventory: The skill possesses the capability to execute shell commands for diagnostics, builds, and version management, but restricts these to intended project-local operations.
- Sanitization: Project data is serialized via
json.dumpsfor safe consumption. The script specifically avoids reading the values of environment variables, reporting only the presence of.envfiles to prevent credential leakage.
Audit Metadata