The Agent Skills Directory

[SAFE]: The skill is a comprehensive documentation set for SvelteKit, focused on teaching best practices for state management and server/client boundaries. It explicitly warns against anti-patterns that could lead to data leaks, such as using module-level variables on the server.
[SAFE]: Environment variable management is described with clear distinctions between private and public scopes. The documentation explains how to use static inlining for dead-code elimination and dynamic variables for runtime configuration, following standard security practices for secret management.
[SAFE]: The remote functions section describes an experimental RPC API. It recommends the use of 'Standard Schema' validation (e.g., Zod or Valibot) for all incoming data, which serves as a critical defense against malformed or malicious inputs.
[INDIRECT_PROMPT_INJECTION]: The skill describes the implementation of features that ingest untrusted user data via forms, URL parameters, and API endpoints.
Ingestion points: User-controlled data enters the system through +page.server.js actions, remote function arguments in *.remote.js, and URL search parameters processed in load functions.
Boundary markers: The skill encourages the use of schema-based validation to define strict boundaries for all external data.
Capability inventory: Capabilities described include filesystem access through the server-only read function, network requests via the fetch API, and data persistence via database integrations.
Sanitization: Sanitization is facilitated through mandatory or recommended schema validation for remote functions and the use of server-only modules ($lib/server/) to isolate sensitive logic from the client.

sveltekit-advanced