svelte-code-writer
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Uses
npxto fetch and execute the official@sveltejs/mcppackage from the NPM registry. This is a standard method for accessing official Svelte development tools. - [COMMAND_EXECUTION]: Invokes CLI tools for Svelte documentation management and code analysis within the local environment. The tools provide functionality for listing documentation sections, fetching content, and running code linting.
- [INDIRECT_PROMPT_INJECTION]: Analyzes user-provided Svelte components and modules. This ingestion of external code is a core function of the skill's autofixing capability.
- Ingestion points: Processes code or file paths provided via the
svelte-autofixercommand arguments inSKILL.md. - Boundary markers: None (uses standard shell arguments).
- Capability inventory: Execution of Node.js-based CLI tools via
npxacross the project filesystem. - Sanitization: Instructs the agent to manually escape shell-sensitive characters like
$in runes to prevent local command injection/variable substitution.
Audit Metadata