svelte-cli

Fail

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The file references/documentation/llms-small.md contains pseudo-system instructions using <SYSTEM> tags and imperative directives (e.g., "You MUST use the Svelte 5 API", "Do NOT treat runes like regular functions") designed to override the agent's default behavior and decision-making regarding code styles and API usage.
  • [COMMAND_EXECUTION]: The file references/troubleshooting.md instructs users to execute export NODE_TLS_REJECT_UNAUTHORIZED=0 to resolve SSL certificate errors. This command disables TLS certificate validation globally for the environment, which is a significant security bypass that exposes all subsequent network traffic to man-in-the-middle attacks.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of the Svelte CLI and various official add-ons from the Svelte organization's repositories and the npm registry using package managers such as npm, bun, and npx.
  • [COMMAND_EXECUTION]: The skill provides utility commands in references/troubleshooting.md such as lsof -ti:5173 | xargs kill -9 to manage local processes and ports.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 26, 2026, 04:35 AM
Security Audit — agent-trust-hub — svelte-cli