vite-agent
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by instructing the agent to ingest and act upon data from local configuration files.\n
- Ingestion points: Reads
vite.config.tsandpackage.jsonto determine server port configurations (SKILL.md).\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the configuration files are provided.\n
- Capability inventory: The agent is instructed to execute
grep,lsof,curl, andkillbased on the data identified in those files (SKILL.md).\n - Sanitization: No sanitization or validation of the configuration file content is performed before its use in shell command templates.\n- [COMMAND_EXECUTION]: Provides shell command templates for identifying and managing local development server processes.\n
- Includes patterns for using
lsofto find processes on specific ports andcurlfor health polling.\n - Includes a pattern for terminating stalled local server instances using
kill -9.\n- [EXTERNAL_DOWNLOADS]: Recommends the installation of thewait-onpackage from the NPM registry, a well-known utility for synchronizing with network resources.
Audit Metadata