vitest
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing standard, well-known development dependencies from the NPM registry. These include
jsdom,happy-dom,@vitest/coverage-v8, and@vitest/coverage-istanbul. These are official or widely recognized ecosystem packages necessary for testing. - [INDIRECT_PROMPT_INJECTION]: The skill documents a testing framework that, by design, processes and executes code from test files and configuration files. This constitutes an inherent attack surface for development-oriented AI agents.
- Ingestion points: Test files (matching
**/*.{test,spec}.ts), configuration files (vitest.config.tsorvite.config.ts), and environment variables viavi.stubEnvorprocess.env. - Boundary markers: None explicitly mentioned in the documentation, as is standard for testing tool references.
- Capability inventory: The framework allows for arbitrary code execution in Node.js or simulated browser environments, file system writes for snapshots and coverage reports, and network operations if invoked within test suites.
- Sanitization: No sanitization is performed by the tool on the code it is instructed to test, which is the expected behavior for a unit testing utility.
Audit Metadata