svelte-code-writer
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the
@sveltejs/mcppackage from the official npm registry. This is an official utility provided by the Svelte project for documentation and context protocol support. - [COMMAND_EXECUTION]: Utilizes
npxto run CLI commands for documentation retrieval and code analysis. The instructions include security best practices for escaping shell characters. - [PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection as it processes external Svelte code through the autofixer utility.
- Ingestion points: Processes arbitrary code strings or local files via the
svelte-autofixercommand defined inSKILL.md. - Boundary markers: No explicit output delimiters or isolation instructions are defined for the agent.
- Capability inventory: Executes shell-based developer tools (
npx). - Sanitization: Instructs the user to escape the
$sign to prevent shell command injection or expansion.
Audit Metadata