svelte-code-writer
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute the@sveltejs/mcppackage directly from the official npm registry. This is a standard practice for running CLI tools without permanent installation. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to interact with the Svelte documentation and analysis tools. Specifically, it uses
list-sections,get-documentation, andsvelte-autofixersubcommands. - [INDIRECT_PROMPT_INJECTION]: The
svelte-autofixertool accepts raw code or file paths as input for analysis. The skill author includes a specific security warning to escape the$character as\$when passing code containing Svelte runes (e.g.,$state) to prevent unintended shell variable substitution or command interpolation. This surface is well-documented and the skill provides appropriate usage patterns to minimize risks.
Audit Metadata