skills/magnus919/agent-skills/vite/Gen Agent Trust Hub

vite

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes system commands and project-local binaries to verify the development environment and perform builds.
  • The scripts/vite-doctor script uses subprocess.run to execute node, npm, pnpm, yarn, bun, and the local vite executable with the --version flag to capture toolchain metadata.
  • Operating instructions in SKILL.md and references/build-and-deploy.md guide the agent to use standard, project-defined package manager scripts for production builds and previews.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project-controlled metadata and configuration files, representing a surface for potential indirect injection.
  • Ingestion points: The scripts/vite-doctor script reads package.json content and performs directory iteration on the project root to identify config and environment files.
  • Boundary markers: The diagnostic tool produces structured JSON output to provide a clear boundary between ingested project data and agent instructions.
  • Capability inventory: The skill possesses the capability to execute shell commands for diagnostics, builds, and version management, but restricts these to intended project-local operations.
  • Sanitization: Project data is serialized via json.dumps for safe consumption. The script specifically avoids reading the values of environment variables, reporting only the presence of .env files to prevent credential leakage.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 05:57 PM
Security Audit — agent-trust-hub — vite