vinext-vite-nextjs

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing several external Node.js packages from the npm registry, including the core migration tool vinext and various Vite plugins.
  • [REMOTE_CODE_EXECUTION]: The skill instructs the user to run npx vinext init, which downloads and executes setup code from a remote package repository to initialize the migration process.
  • [COMMAND_EXECUTION]: The skill defines multiple CLI commands for application lifecycle management and deployment, including vinext dev, vinext build, vinext deploy, and wrangler login.
  • [INDIRECT_PROMPT_INJECTION]: The skill's migration logic involves reading and modifying existing project configuration and source files, which creates a potential surface for indirect prompt injection.
  • Ingestion points: Project files including next.config.js, package.json, and source files within the app/ and pages/ directories.
  • Boundary markers: None identified; the instructions do not include specific delimiters or warnings to ignore embedded content in processed files.
  • Capability inventory: The skill possesses the ability to modify package.json scripts, rename configuration files, generate new vite.config.ts files, and execute shell commands.
  • Sanitization: The instructions do not define any sanitization or validation steps for content extracted from project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 08:37 PM
Security Audit — agent-trust-hub — vinext-vite-nextjs