migrate-to-vinext
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run various shell commands for project migration, including
npm install,vite build,vinext init, and deployment commands likenpx @vinext/cloudflare deployandvp exec vinext-cloudflare deploy. These are standard operations for project setup and deployment. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of multiple Node.js packages from the NPM registry, such as
vinext,vite,nitro, and@cloudflare/vite-plugin. These dependencies are necessary for the framework's functionality and the migration process. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes user-controlled project files, including
package.jsonandnext.config.js, to determine the migration path. * Ingestion points: The skill analyzespackage.json,next.config.js, and the project's directory structure (SKILL.md). * Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore potentially malicious content within the analyzed project files. * Capability inventory: The agent has the capability to execute shell commands (npm,npx,vp), write configuration files (vite.config.ts), and access environment variables. * Sanitization: No explicit sanitization or validation of the input configuration data is described beyond checking for the presence of thenextdependency.
Audit Metadata