安全扫描
OpenClaw
安全
high confidenceThe skill is an instruction-only Vite plugin development guide whose requirements and instructions match its stated purpose; nothing requested or installed is disproportionate or unexplained.
评估建议
This is a documentation-style skill for developing Vite plugins and is internally consistent. It does not request credentials or perform any installs. Before using or copying example code into real projects, be careful not to: (1) expose sensitive environment variables via virtual modules or define injections (avoid using process.env values that contain secrets), (2) publish dev-only middleware or endpoints to production, and (3) blindly copy examples that embed build-time env values into client...详细分析 ▾
✓ 用途与能力
Name/description (Vite plugin development) align with the provided content: scaffolding, hook patterns, HMR, SSR, testing, and publishing. The skill declares no binaries, env vars, or installs, which is reasonable for a docs/instruction-only skill.
ℹ 指令范围
SKILL.md stays on-topic and provides code patterns and checklists for plugin authors. Two patterns merit attention: (1) virtual modules and build-info examples read process.env (e.g., npm_package_version, NODE_ENV) and could expose env values to client code if copied verbatim; (2) dev-server middleware examples create local HTTP endpoints, which is expected in dev but should not be used to expose secrets or production data. The instructions do not tell the agent to read arbitrary system files, external endpoints, or transmit data off-host.
✓ 安装机制
No install spec and no code files that would be written/executed by an installer. Instruction-only skills are lowest risk for install-time code execution.
ℹ 凭证需求
The skill requests no environment variables or credentials. However, examples show accessing process.env and injecting config into client code; plugin authors must avoid embedding secrets into virtual modules or define/config injection. The examples themselves are not requesting credentials, but they show patterns that could accidentally leak sensitive env values if misused.
✓ 持久化与权限
always is false, no persistence or system-wide configuration changes are requested, and the skill does not instruct modification of other skills or global agent settings.
安全有层次,运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/16
Initial release
● 无害
安装命令
点击复制官方npx clawhub@latest install vite-plugin-dev
镜像加速npx clawhub@latest install vite-plugin-dev --registry https://cn.longxiaskill.com
技能文档
When to Use
- Building a custom Vite plugin from scratch
- Implementing transform/resolve hooks for special file types
- Creating virtual modules or runtime injections
- Adding HMR (Hot Module Replacement) support
- Making plugins SSR-compatible
- Publishing a plugin package to npm
Core Workflow
1. Plugin Scaffold
Every Vite plugin is a factory function returning a plugin object:import type { Plugin } from 'vite'export interface MyPluginOptions { include?: string | RegExp | (string | RegExp)[] exclude?: string | RegExp | (string | RegExp)[] }
export default function myPlugin(options: MyPluginOptions = {}): Plugin { return { name: 'vite-plugin-my', // required, unique name enforce: 'pre', // 'pre' | 'post' | undefined apply: 'build', // 'build' | 'serve' | ((config, env) => bool)
// lifecycle hooks below... } }
2. Key Hooks
| Hook | Phase | Purpose |
|---|---|---|
config | Both | Modify resolved config |
configResolved | Both | Read final config |
buildStart | Both | Initialize plugin state |
resolveId | Both | Custom module resolution |
load | Both | Custom module content |
transform | Both | Code transformation |
generateBundle | Build | Post-process output |
configureServer | Serve | Extend dev server |
handleHotUpdate | Serve | Custom HMR logic |
3. Transform Hook Pattern
transform(code, id) {
if (!id.endsWith('.myext')) return null // return null = skip
const transformed = doTransform(code)
return {
code: transformed,
map: null, // provide sourcemap when possible
}
},
4. Virtual Modules
const VIRTUAL_ID = 'virtual:my-module' const RESOLVED_ID = '\0' + VIRTUAL_ID // prefix \0 to avoid collisions
resolveId(id) { if (id === VIRTUAL_ID) return RESOLVED_ID }, load(id) { if (id === RESOLVED_ID) { returnexport const data = ${JSON.stringify(myData)}} },
5. HMR Support
handleHotUpdate({ file, server }) {
if (file.endsWith('.myext')) {
server.ws.send({ type: 'full-reload' })
return [] // prevent default HMR
}
},
6. SSR Compatibility Checklist
- Check
options.ssrintransform/loadhooks - Avoid browser-only APIs at transform time
- Mark side-effect-free modules: set
moduleSideEffects: false - Test with
vite build --ssr
7. Testing Strategy
// Use vite's createServer for integration tests
import { createServer } from 'vite'
const server = await createServer({ plugins: [myPlugin()] })
const mod = await server.ssrLoadModule('/src/test.myext')
Publishing Checklist
- [ ]
package.jsonmain+module+typesfields set - [ ]
peerDependencies:"vite": "^5.0.0 || ^6.0.0" - [ ] README with usage example + options table
- [ ] Export TypeScript types
- [ ] Test against Vite 5 and 6
- [ ]
vite-plugin-prefix in package name (ecosystem convention)