svelte-ai
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to utilize the
@sveltejs/mcppackage vianpx. This enables the local execution of Svelte's official Model Context Protocol server for documentation retrieval and code validation. - [EXTERNAL_DOWNLOADS]: The skill fetches documentation and tool metadata from official Svelte domains, such as
svelte.devandmcp.svelte.dev. These sources are well-known and trusted technology domains. - [REMOTE_CODE_EXECUTION]: Users are provided with options to configure a remote MCP server via the URL
https://mcp.svelte.dev/mcp. This is an official service provided by the Svelte team to support AI integrations without local environment modification. - [PROMPT_INJECTION]: The skill defines a structured prompt,
svelte-task, which contains directives ensuring the agent uses Svelte 5 runes and linter tools correctly. These instructions are designed to maintain code consistency and quality rather than bypassing security controls. - [DATA_EXFILTRATION]: The
playground-linktool is documented as generating URLs that encode the project's source code in the URL hash. The skill includes explicit safeguards, instructing the agent to only call this tool after obtaining user consent and to avoid its use when files have already been written locally.
Audit Metadata