svelte-template-syntax
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were identified. The skill is entirely educational and technical in nature, focusing on documenting Svelte 5 framework features.
- [INDIRECT_PROMPT_INJECTION]: The skill documents the
{@html}directive, which allows rendering of raw HTML strings. 1. Ingestion points: The directive is documented inSKILL.mdandreferences/special-tags.md. 2. Boundary markers: The skill includes explicit warnings about XSS risks and 'Quick Fixes' suggesting safer alternatives or:globalmodifiers. 3. Capability inventory: The skill documents event handling (onclick), DOM references (bind:this), and attachment logic (@attach). 4. Sanitization: The documentation explicitly recommends sanitizing content before use with the tag. - [DYNAMIC_EXECUTION]: The documentation includes standard framework features for dynamic component rendering (
svelte:component,svelte:element) and asynchronous component loading using dynamicimport()within{#await}blocks. These are documented safely as part of the framework's core functionality.
Audit Metadata