vinext-vite-nextjs
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing several external Node.js packages from the npm registry, including the core migration tool
vinextand various Vite plugins. - [REMOTE_CODE_EXECUTION]: The skill instructs the user to run
npx vinext init, which downloads and executes setup code from a remote package repository to initialize the migration process. - [COMMAND_EXECUTION]: The skill defines multiple CLI commands for application lifecycle management and deployment, including
vinext dev,vinext build,vinext deploy, andwrangler login. - [INDIRECT_PROMPT_INJECTION]: The skill's migration logic involves reading and modifying existing project configuration and source files, which creates a potential surface for indirect prompt injection.
- Ingestion points: Project files including
next.config.js,package.json, and source files within theapp/andpages/directories. - Boundary markers: None identified; the instructions do not include specific delimiters or warnings to ignore embedded content in processed files.
- Capability inventory: The skill possesses the ability to modify
package.jsonscripts, rename configuration files, generate newvite.config.tsfiles, and execute shell commands. - Sanitization: The instructions do not define any sanitization or validation steps for content extracted from project files.
Audit Metadata