svelte-cli
Fail
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The file
references/documentation/llms-small.mdcontains pseudo-system instructions using<SYSTEM>tags and imperative directives (e.g., "You MUST use the Svelte 5 API", "Do NOT treat runes like regular functions") designed to override the agent's default behavior and decision-making regarding code styles and API usage. - [COMMAND_EXECUTION]: The file
references/troubleshooting.mdinstructs users to executeexport NODE_TLS_REJECT_UNAUTHORIZED=0to resolve SSL certificate errors. This command disables TLS certificate validation globally for the environment, which is a significant security bypass that exposes all subsequent network traffic to man-in-the-middle attacks. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of the Svelte CLI and various official add-ons from the Svelte organization's repositories and the npm registry using package managers such as
npm,bun, andnpx. - [COMMAND_EXECUTION]: The skill provides utility commands in
references/troubleshooting.mdsuch aslsof -ti:5173 | xargs kill -9to manage local processes and ports.
Recommendations
- AI detected serious security threats
Audit Metadata