webpack-to-vite-config-translator
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill explicitly defines security boundaries in its core instructions, including prohibitions on
eval, remote script execution (specificallycurl | bash), and file operations outside the target project scope. - [COMMAND_EXECUTION]: The skill includes a local utility script (
scripts/audit-webpack-config.sh) to scan for build configurations. This script implements input validation and path traversal checks (*"/../"*) and is intended for read-only auditing. The skill also directs the agent to manage dependencies using standard package managers with explicit user confirmation. - [EXTERNAL_DOWNLOADS]: Migration workflows involve downloading standard development dependencies and plugins from public registries via
npm. This behavior is expected for a build tool migration utility and is governed by safe-practice instructions. - [PROMPT_INJECTION]: As the skill ingests and processes Webpack configuration files from external projects, it possesses an Indirect Prompt Injection surface.
- Ingestion points: The
audit-webpack-config.shscript and the agent's file-reading capabilities ingest untrusted project data. - Boundary markers: The instructions do not explicitly mandate delimiters for external content, though the structured phase-based approach provides logical separation.
- Capability inventory: The skill can execute shell scripts and package manager commands (
npm install) and write configuration files. - Sanitization: The audit script performs basic path validation to ensure file access is scoped to the project directory.
Audit Metadata