sveltekit-data
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for handling external data which creates an indirect prompt injection surface.
- Ingestion points: Untrusted data enters the agent context through SvelteKit Form Actions (
request.formData()) and URL parameters (params,url.searchParams) as documented in SKILL.md and references/form-actions-reference.md. - Boundary markers: The documentation does not specify the use of delimiters to isolate external content when processed within agent prompts.
- Capability inventory: The skill examples demonstrate capabilities including file system writes (
fs.writeFile), network requests (fetch), and session management (cookies.set) as shown in examples/form-actions.md and examples/load-functions.md. - Sanitization: The skill advises against echoing sensitive fields like passwords in responses, although it does not provide comprehensive sanitization for all input-driven operations like file path construction.
Audit Metadata