weapp-vite-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project data that could contain malicious instructions designed to manipulate the agent's behavior.\n
- Ingestion points: Reads and analyzes content from project files including
vite.config.ts,app.json,package.json, andAGENTS.md.\n - Boundary markers: The instructions do not specify the use of delimiters or instructions for the agent to ignore embedded prompts within these files.\n
- Capability inventory: The agent is empowered to execute CLI commands (
wv), interact with theweapp-ide-cli, and manage code compilation and deployment tasks.\n - Sanitization: There are no mentioned procedures for validating or sanitizing the content of ingested configuration files before they influence agent logic.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of development dependencies and official SDKs, such as
miniprogram-ci(Tencent) and vendor-related packages like@weapp-vite/i18n. These are standard tools for the Mini Program development environment.\n- [COMMAND_EXECUTION]: The skill allows the agent to execute a variety of project management commands using thewvCLI for building, uploading, and analyzing projects. These operations are core to the skill's intended functionality.
Audit Metadata