writing-vite-devtools-integrations
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The framework allows integrations to spawn and manage child processes (e.g., build watchers or development servers) using the
ctx.terminals.startChildProcessAPI. This is a documented core feature for build tool extensions.- [DYNAMIC_EXECUTION]: The system supports the dynamic loading of client-side scripts for custom action buttons and renderers through theimportFromproperty in dock entry configurations.- [EXTERNAL_DOWNLOADS]: The documentation includes patterns for 'Remote-hosted UI' where an iframe dock connects to an external hosted website, establishing a WebSocket connection back to the local development server.- [DATA_EXFILTRATION]: When utilizing remote-hosted UIs, the kit transmits a session-scoped authentication token and connection metadata to the remote origin via URL fragments to facilitate secure communication.- [INDIRECT_PROMPT_INJECTION]: The framework serves as an aggregation point for various data sources, including build logs, RPC results, and user inputs, which represents a potential attack surface for indirect prompt injection if downstream tools do not properly sanitize ingested content.
Audit Metadata