CtrlK
BlogDocsLog inGet started
Tessl Logo

uinaf/viteplus

Migrate or align frontend repositories to the stock VitePlus workflow. Use when standardizing package or monorepo repos around `vp`, `voidzero-dev/setup-vp`, `vite-plus/test`, and VitePlus-native CI, test, and packaging flows, including updating scripts, test config, CI setup, and packaging commands.

98

1.73x
Quality

100%

Does it follow best practices?

Impact

97%

1.73x

Average score across 6 eval scenarios

SecuritybySnyk

Passed

No known issues

This version of the tile failed moderation
Failed moderation (intent review) in tile.json: This is a potential supply chain attack via typosquatting/dependency confusion. The package name 'uinaf/viteplus' mimics the popular 'Vite' ecosystem (vite-plus, voidzero-dev). It's designed as an AI agent tile/skill that instructs AI coding assistants to modify package scripts, CI configurations, and packaging commands in repositories - effectively a prompt injection attack. The skill directs AI agents to replace legitimate tooling with attacker-controlled alternatives ('vp', 'voidzero-dev/setup-vp', 'vite-plus/test'), which could introduce malicious dependencies across many repositories when an AI agent follows these instructions.
Overview
Quality
Evals
Security
Files

criteria.jsonevals/scenario-5/

{
  "context": "Tests whether the agent correctly sets up root-level build and development scripts for a VitePlus monorepo containing a publishable UI library and a documentation/demo app. The key instructions involve using the correct topological build flag, avoiding a known pnpm filter bug, using the documented library-seed-then-parallel-dev pattern, and not introducing external task runners.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "vp run -t for build chain",
      "description": "The build or deploy script for the demo app uses `vp run -t` (with the topological flag) to build the app and its workspace dependencies, rather than a plain `vp run` or a package-manager filter",
      "max_score": 15
    },
    {
      "name": "No pnpm --filter ellipsis",
      "description": "No script or CI step uses `pnpm --filter '...<pkg>'` (leading-ellipsis form) for any transitive build or dependency-inclusive task",
      "max_score": 15
    },
    {
      "name": "Library build seed in dev script",
      "description": "The dev script (e.g. `dev:docs` or `dev:demo`) first runs a one-shot build of the library (`vp run <lib>#build` or equivalent) before starting the parallel dev phase — it does NOT jump straight into a parallel watch without seeding the library's dist/",
      "max_score": 12
    },
    {
      "name": "--parallel flag in dev",
      "description": "The dev script uses `vp run -r --parallel dev` (or equivalent) for the parallel phase that starts all packages' dev tasks simultaneously after seeding",
      "max_score": 10
    },
    {
      "name": "No external task-runner invented",
      "description": "The output does NOT introduce a Turborepo config (`turbo.json`), Nx workspace config (`nx.json`), or any other custom shell-based task-runner wrapper to express cross-package dependency ordering",
      "max_score": 10
    },
    {
      "name": "Library watch uses vp pack --watch",
      "description": "The library package's watch-mode script uses `vp pack --watch` (not `vite build --watch`, `vitest --watch`, or a plain `vp build --watch`) for the library build watcher",
      "max_score": 10
    },
    {
      "name": "Build-first for demo app",
      "description": "The demo/docs app does NOT configure a Vite `resolve.alias` pointing to the library's `src/` folder — the integration point is the library's built `dist/` artifact, not the source tree",
      "max_score": 10
    },
    {
      "name": "Single workspace-wide hook config",
      "description": "Commit-hook configuration is set at the workspace root level (e.g. in root `vite.config.ts` `staged` block or a single `vp config`-managed `.vite-hooks`) rather than defined separately per package",
      "max_score": 8
    },
    {
      "name": "No direct package manager for VitePlus-owned tasks",
      "description": "Scripts in the root `package.json` do NOT use `pnpm run`, `npm run`, or `yarn run` for any task that VitePlus owns (install, test, build, check) — those use `vp` commands or `vp run` instead",
      "max_score": 10
    }
  ]
}

evals

SKILL.md

tile.json