migrate-to-vinext

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands for project migration, including npm install, vite build, vinext init, and deployment commands like npx @vinext/cloudflare deploy and vp exec vinext-cloudflare deploy. These are standard operations for project setup and deployment.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of multiple Node.js packages from the NPM registry, such as vinext, vite, nitro, and @cloudflare/vite-plugin. These dependencies are necessary for the framework's functionality and the migration process.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads and processes user-controlled project files, including package.json and next.config.js, to determine the migration path. * Ingestion points: The skill analyzes package.json, next.config.js, and the project's directory structure (SKILL.md). * Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore potentially malicious content within the analyzed project files. * Capability inventory: The agent has the capability to execute shell commands (npm, npx, vp), write configuration files (vite.config.ts), and access environment variables. * Sanitization: No explicit sanitization or validation of the input configuration data is described beyond checking for the presence of the next dependency.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 10:44 PM