The Agent Skills Directory

[COMMAND_EXECUTION] (SAFE): The skill references standard Vite CLI commands (vite, vite build, vite preview). These are the primary functions of the tool and are documented for legitimate use.
[DATA_EXFILTRATION] (LOW): The documentation includes examples of loadEnv using an empty prefix (''). While a standard Vite feature, this practice loads all system environment variables into the configuration object, bypassing the default security filter that only exposes variables prefixed with VITE_. Users should be cautioned that this can accidentally expose secrets if the configuration object is logged or shared.
[DYNAMIC_EXECUTION] (LOW): The skill covers dynamic loading features such as import.meta.glob and ssrLoadModule. These are core Vite capabilities used for file discovery and Server-Side Rendering (SSR), though they represent a dynamic code execution surface.
[PROMPT_INJECTION] (LOW): The skill has an indirect prompt injection surface (Category 8) because it is designed to ingest and process local project files such as vite.config.ts, index.html, and .env files.
Ingestion points: Reads project configuration, environment variables, and HTML templates via fs.readFile and loadEnv.
Boundary markers: None; instructions are processed as code/configuration.
Capability inventory: Can execute build commands, start dev servers, and perform file system reads.
Sanitization: None; as a build tool, it expects to execute the provided configuration.

vite