The Agent Skills Directory

PROMPT_INJECTION (SAFE): No instructions were found that attempt to override agent behavior, bypass safety filters, or extract system prompts. Instructional language is focused strictly on Svelte development patterns.
DATA_EXPOSURE (SAFE): No hardcoded credentials, API keys (except for placeholder names like 'sk_live_abc123' used in educational 'Incorrect' examples), or sensitive file paths were detected. The skill provides correct advice on using $env/static/private for secret management.
OBFUSCATION (SAFE): The content is entirely in clear-text Markdown and standard JavaScript/TypeScript snippets. No Base64 encoding, zero-width characters, or homoglyph-based attacks were identified.
EXTERNAL_DOWNLOADS (SAFE): The skill references standard, well-known libraries in the Svelte ecosystem (e.g., Kysely, Better Auth, shadcn-svelte, Vercel AI SDK). No suspicious or unverified remote script downloads are included.
COMMAND_EXECUTION (SAFE): The skill contains no executable code or scripts. It provides code snippets for the developer to use, none of which contain arbitrary command execution or shell injection patterns.
INDIRECT_PROMPT_INJECTION (SAFE): While the skill defines how the agent should interpret data, it provides explicit sanitization guidance (e.g., using DOMPurify for user comments) which actively mitigates indirect injection risks in the final application.
PRIVILEGE_ESCALATION (SAFE): No commands related to privilege escalation (sudo, chmod 777, etc.) were found.
PERSISTENCE (SAFE): No attempts to modify shell profiles or system startup services were detected.
DYNAMIC_EXECUTION (SAFE): No use of eval(), exec(), or runtime code generation with untrusted inputs was found.

sveltekit-builder