The Agent Skills Directory

[SAFE]: The skill provides standard technical documentation and examples for Svelte 5 runtime features. The content is educational and aligns with its stated purpose without including any malicious instructions or hidden behaviors.
[SAFE]: Extensive guidance is provided on implementing Content Security Policy (CSP) to protect against Cross-Site Scripting (XSS) when using hydratable data in server-side rendering, which is a significant security best practice.
[EXTERNAL_DOWNLOADS]: The documentation references the installation of vitest via npm. Vitest is a well-known and trusted testing framework, and its usage here is appropriate and safe.
[SAFE]: The skill defines patterns for processing data from external APIs, creating a surface for potential indirect prompt injection (Category 8).
Ingestion points: Data enters the component context through fetch() calls and the hydratable() API as documented in examples/onmount-tick.md and SKILL.md.
Boundary markers: The skill recommends using Content Security Policy (CSP) nonces to authorize and secure injected bootstrap scripts.
Capability inventory: The Svelte runtime provides capabilities for DOM manipulation and script execution during the hydration phase across the provided examples.
Sanitization: The skill includes a security checklist in references/ssr-reference.md that explicitly advises sanitizing data before passing it to the render() function to prevent injection attacks.

svelte-runtime