skills/onmax/vite-doctor/doctor/Gen Agent Trust Hub

doctor

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and executes the vite-doctor package from the NPM registry using the pnpm dlx command. This resource is associated with the author's known infrastructure (onmax.me).
  • [COMMAND_EXECUTION]: The agent is directed to run shell commands to perform diagnostics (pnpm dlx vite-doctor .) and manage development dependencies (pnpm add -D vite-doctor, pnpm nuxt doctor).
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it analyzes external, untrusted source code within a project to generate diagnostic fixes.
  • Ingestion points: Files within the target project analyzed by the vite-doctor CLI (SKILL.md).
  • Boundary markers: Absent; there are no specific instructions or delimiters to prevent the agent from following malicious instructions embedded as comments or metadata in the analyzed project files.
  • Capability inventory: The agent is empowered to execute shell commands and perform code edits based on diagnostic results.
  • Sanitization: Absent; the skill does not implement validation or escaping for the data ingested from project files before it is used to guide the agent's remediation actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 03:33 PM
Security Audit — agent-trust-hub — doctor