sveltekit
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of official packages from well-known services, including @supabase/supabase-js, @supabase/ssr, and @sveltejs/adapter-cloudflare. These are standard, reputable dependencies for SvelteKit and Supabase integrations.\n- [INDIRECT_PROMPT_INJECTION]: The code patterns include the use of the {@html} tag to render content from a load function, identifying an injection surface for Cross-Site Scripting (XSS). \n
- Ingestion points: External data enters via params.slug and request.formData(). \n
- Boundary markers: Zod schemas are used for form input validation. \n
- Capability inventory: The skill manages file routing and server-side requests. \n
- Sanitization: Zod handles form validation, but no explicit HTML sanitization is shown for rendering via {@html}. Developers should ensure data is sanitized to mitigate XSS risks.
Audit Metadata