vite-plus
Fail
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation guide in SKILL.md instructs users to pipe remote scripts directly into system interpreters using
curl -fsSL https://vite.plus | bashandirm https://vite.plus/ps1 | iex. This is a high-severity RCE pattern that executes remote code without validation or local inspection. - [EXTERNAL_DOWNLOADS]: The skill relies on external code and installers hosted at
https://vite.plus, which is an unverified domain not associated with any trusted organization or well-known service in the security manifest. - [COMMAND_EXECUTION]: The skill includes a 'Companion check' section that directs the AI agent to run directory listing commands (
ls) on sensitive paths in the user's home directory to detect other installed skills, which constitutes unauthorized environment fingerprinting.
Recommendations
- HIGH: Downloads and executes remote code from: https://vite.plus - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata