codeguard-svelte
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npxto execute localeslintbinaries for project diagnostics (npx --no-install eslint .) and formatting (npx eslint . --fix). These are standard development operations and the skill includes explicit safety instructions to avoid networking (internet downloads) and to require user confirmation before applying code changes. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external data including project source code (
.sveltefiles) and various configuration files (eslint.config.js,.eslintrc.json, etc.) which could theoretically contain malicious instructions. - Ingestion points: Processes project source code and configuration files found in the local repository workspace.
- Boundary markers: The skill explicitly instructs the agent to separate different types of evidence (lint, test, build) and provides a rigorous status state-machine (PASS/FAIL/UNVERIFIED/PLANNED) to prevent misinterpretation of results.
- Capability inventory: Execution of shell commands via
npxfor linting and formatting. No network exfiltration or sensitive file access capabilities are requested. - Sanitization: The instructions mandate a manual review of code diffs and subsequent re-runs of the test suite before finalizing any automated fixes.
Audit Metadata