svelte-template-directives
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the
{@html}directive, which allows for the direct rendering of HTML strings and can serve as a surface for XSS or indirect prompt injection if processing untrusted data. The skill mitigates this by including a 'Security Warning' and clear implementation examples for input sanitization. - Ingestion points: The
{@html}directive located inreferences/other-directives.mdacts as the primary ingestion point for string-to-DOM rendering. - Boundary markers: While the directive itself provides no boundary, the skill instructs developers to create a sanitized boundary using derived state and external libraries.
- Capability inventory: The skill allows for reactive DOM updates, event listener attachment, and integration with third-party JavaScript libraries.
- Sanitization: Present and emphasized. The skill provides code examples using
DOMPurifyto ensure content is safe before being passed to the directive.
Audit Metadata