The Agent Skills Directory

[METADATA_POISONING]: The skill provides documentation for non-existent software versions and features. Multiple files (e.g., references/runes-reactivity.md, references/sveltekit-remote-functions.md) claim to be verified in March and April 2026. The documentation describes a 'Remote Functions' API (using .remote.ts files and imports from $app/server) and SvelteKit version 2.58.0, neither of which exist in the current ecosystem. This deceptive metadata could lead an agent to generate non-functional code or attempt to use non-existent tools.
[COMMAND_EXECUTION]: The tooling.md and SKILL.md files instruct the agent to use the shell tool to execute npx @sveltejs/mcp. This involves running an external CLI package from a remote registry with high-privilege access to the environment.
[INDIRECT_PROMPT_INJECTION]: The skill creates a command injection vulnerability surface by suggesting the agent pass user-provided code directly into a shell command via npx @sveltejs/mcp svelte-autofixer "<code_or_path>".
Ingestion points: User-supplied Svelte code and file paths (processed in SKILL.md and references/tooling.md).
Boundary markers: The skill lacks programmatic boundary markers or sanitization logic, though it includes a text-based warning for the agent to escape the $ character.
Capability inventory: The skill encourages use of the shell to run npx and other build tools (pnpm).
Sanitization: No automated sanitization is present; the skill relies entirely on the agent's ability to safely handle shell interpolation.
[EXTERNAL_DOWNLOADS]: The skill references and suggests the installation of numerous external packages including bits-ui, @ark-ui/svelte, @melt-ui/svelte, and specifically the @sveltejs/mcp package via npx. While many belong to the well-known Svelte ecosystem, the @sveltejs/mcp package is not a standard official tool, posing a potential supply-chain execution risk.

with-svelte