svelte-code-writer

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads and executes the @sveltejs/mcp package from the official Svelte organization using the npx command. This is a standard and safe practice for providing documentation and tooling.
  • [INDIRECT_PROMPT_INJECTION]: The svelte-autofixer tool processes external Svelte components and code blocks, which can contain malicious instructions intended to influence the agent. 1. Ingestion points: Code strings or file paths provided to the tool via the command line. 2. Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded content. 3. Capability inventory: Use is restricted to code analysis with no high-privilege capabilities exposed. 4. Sanitization: No sanitization is performed on input code.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 04:18 AM
Security Audit — agent-trust-hub — svelte-code-writer