skills/pedronauck/skills/vitest/Gen Agent Trust Hub

vitest

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing standard, well-known development dependencies from the NPM registry. These include jsdom, happy-dom, @vitest/coverage-v8, and @vitest/coverage-istanbul. These are official or widely recognized ecosystem packages necessary for testing.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents a testing framework that, by design, processes and executes code from test files and configuration files. This constitutes an inherent attack surface for development-oriented AI agents.
  • Ingestion points: Test files (matching **/*.{test,spec}.ts), configuration files (vitest.config.ts or vite.config.ts), and environment variables via vi.stubEnv or process.env.
  • Boundary markers: None explicitly mentioned in the documentation, as is standard for testing tool references.
  • Capability inventory: The framework allows for arbitrary code execution in Node.js or simulated browser environments, file system writes for snapshots and coverage reports, and network operations if invoked within test suites.
  • Sanitization: No sanitization is performed by the tool on the code it is instructed to test, which is the expected behavior for a unit testing utility.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:02 PM
Security Audit — agent-trust-hub — vitest