svelte
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute the@sveltejs/mcppackage. This package is the official Model Context Protocol server maintained by the Svelte organization. - [REMOTE_CODE_EXECUTION]: The CLI tool is executed remotely via
npxto provide documentation and code analysis capabilities, which is the intended purpose of the skill. - [COMMAND_EXECUTION]: The skill defines a set of commands for documentation lookup and automated code fixing using the Svelte MCP tool.
- [PROMPT_INJECTION]: The
svelte-autofixertool creates a surface for indirect prompt injection by processing external code files for analysis. - Ingestion points: Component source code or file paths provided to the fixer tool in
SKILL.md. - Boundary markers: The skill advises escaping shell characters but lacks specific markers to delimit analyzed code from agent instructions.
- Capability inventory: Executes the Svelte analysis tool via a shell environment.
- Sanitization: The skill relies on the official tool's internal logic for parsing and suggesting modifications to source code.
Audit Metadata