sveltekit-remote-functions
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and examples for experimental SvelteKit features with a strong focus on secure implementation patterns.
- [SAFE]: It explicitly instructs the agent and the developer to use standard schema validation (such as Valibot or Zod) for all server-side functions exposed as remote endpoints, preventing injection and malformed data processing.
- [SAFE]: The guidance includes specific measures for protecting sensitive data, such as prefixing form fields with an underscore to disable repopulation for secrets like passwords or tokens.
- [SAFE]: It identifies potential Denial of Service (DoS) vectors in client-controlled data refresh patterns and mandates the use of a
limitparameter to bound execution complexity. - [SAFE]: Advice regarding file uploads correctly warns against trusting client-side metadata and recommends server-side type and size validation.
Audit Metadata