doctor
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the
vite-doctorpackage from the NPM registry using thepnpm dlxcommand. This resource is associated with the author's known infrastructure (onmax.me). - [COMMAND_EXECUTION]: The agent is directed to run shell commands to perform diagnostics (
pnpm dlx vite-doctor .) and manage development dependencies (pnpm add -D vite-doctor,pnpm nuxt doctor). - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it analyzes external, untrusted source code within a project to generate diagnostic fixes.
- Ingestion points: Files within the target project analyzed by the
vite-doctorCLI (SKILL.md). - Boundary markers: Absent; there are no specific instructions or delimiters to prevent the agent from following malicious instructions embedded as comments or metadata in the analyzed project files.
- Capability inventory: The agent is empowered to execute shell commands and perform code edits based on diagnostic results.
- Sanitization: Absent; the skill does not implement validation or escaping for the data ingested from project files before it is used to guide the agent's remediation actions.
Audit Metadata