svelte-code-writer
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses npx to run commands from the @sveltejs/mcp package, such as list-sections, get-documentation, and svelte-autofixer. These are legitimate developer tools for the Svelte ecosystem.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the @sveltejs/mcp package from the official NPM registry, which is a well-known and standard service for JavaScript dependencies.
- [DATA_EXFILTRATION]: The skill's access to local Svelte files is limited to the purpose of code analysis and refactoring, with no evidence of unauthorized data transfer.
- [PROMPT_INJECTION]: No malicious instructions designed to bypass agent constraints were found. The skill includes a warning to escape special characters in shell commands to prevent accidental execution issues.
Audit Metadata