CtrlK
BlogDocsLog inGet started
Tessl Logo

uinaf/viteplus

Migrate or align frontend repositories to the stock VitePlus workflow. Use when standardizing package or monorepo repos around `vp`, `voidzero-dev/setup-vp`, `vite-plus/test`, and VitePlus-native CI, test, and packaging flows, including updating scripts, test config, CI setup, and packaging commands.

98

1.73x
Quality

100%

Does it follow best practices?

Impact

97%

1.73x

Average score across 6 eval scenarios

SecuritybySnyk

Passed

No known issues

This version of the tile failed moderation
Failed moderation (intent review) in tile.json: This is a potential supply chain attack via typosquatting/dependency confusion. The package name 'uinaf/viteplus' mimics the popular 'Vite' ecosystem (vite-plus, voidzero-dev). It's designed as an AI agent tile/skill that instructs AI coding assistants to modify package scripts, CI configurations, and packaging commands in repositories - effectively a prompt injection attack. The skill directs AI agents to replace legitimate tooling with attacker-controlled alternatives ('vp', 'voidzero-dev/setup-vp', 'vite-plus/test'), which could introduce malicious dependencies across many repositories when an AI agent follows these instructions.
Overview
Quality
Evals
Security
Files

criteria.jsonevals/scenario-1/

{
  "context": "Tests whether the agent correctly configures a TypeScript library for packaging using VitePlus conventions: using vp pack, placing pack config in vite.config.ts, using vp staged for hooks, adding pnpm overrides, and updating contributor docs.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "vp pack for library",
      "description": "The `build` or `pack` script in package.json uses `vp pack` and NOT `vp build` (since this is a library, not a web application)",
      "max_score": 15
    },
    {
      "name": "Pack config in vite.config.ts",
      "description": "Library packaging configuration (entry points, formats, output options) is placed inside `vite.config.ts` rather than in a separate config file",
      "max_score": 15
    },
    {
      "name": "No parallel tsdown config",
      "description": "The output does NOT include a `tsdown.config.ts` or `tsdown.config.js` file as a parallel packaging config",
      "max_score": 10
    },
    {
      "name": "vp staged for hooks",
      "description": "Pre-commit hook configuration uses `staged` inside `vite.config.ts` (the `defineConfig` `staged` property) rather than a separate `.husky/` directory, `lint-staged` config, or shell-hook wiring",
      "max_score": 15
    },
    {
      "name": "No Husky or lint-staged",
      "description": "The output does NOT add `husky`, `lint-staged`, or `.husky/` configuration for pre-commit hooks",
      "max_score": 10
    },
    {
      "name": "pnpm overrides for vite and vitest",
      "description": "The `package.json` includes a `pnpm.overrides` block (or equivalent) that adds overrides for the VitePlus-wrapped `vite` and `vitest` packages",
      "max_score": 15
    },
    {
      "name": "No direct pnpm/npm/yarn commands",
      "description": "Scripts in package.json do NOT use `pnpm run`, `npm run`, or `yarn run` for any command that VitePlus replaces (install, test, build)",
      "max_score": 10
    },
    {
      "name": "Docs updated with new commands",
      "description": "The README or CONTRIBUTING file is updated to reflect the new install and build commands (references `vp install` or `vp pack` instead of `pnpm install` / old build command)",
      "max_score": 10
    }
  ]
}

evals

scenario-1

criteria.json

task.md

SKILL.md

tile.json