svelte-cli
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical reference for official Svelte development tools. All documented behaviors are standard for CLI-based project management and scaffolding software.
- [EXTERNAL_DOWNLOADS]: The documentation covers features like
sv create --from-playground, which fetches project templates from the trustedsvelte.devdomain. It also describes the installation of official and community add-ons via standard package managers (npm, pnpm, bun, etc.), which is the primary intended function of the tool. - [COMMAND_EXECUTION]: The skill documents the
sv.executeAPI available to custom add-on authors. This is a documented capability of the Svelte CLI framework intended to allow integrations to run necessary setup commands (e.g., initializing a database or running a formatter). - [INDIRECT_PROMPT_INJECTION]: The skill identifies the project scaffolding process as an ingestion point for external data (playground URLs). However, as this is the tool's core purpose and targets official Svelte infrastructure, it does not constitute a malicious pattern.
Audit Metadata