sveltekit-progressive-architecture
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use the
npx shadcn-sveltecommand to download and install UI components. This targets the well-known shadcn-svelte community library, which is a standard practice for Svelte development. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to perform project maintenance tasks such as readingpackage.json, creating directories, and installing components vianpx. These operations are consistent with the skill's primary purpose of SvelteKit project management. - [INDIRECT_PROMPT_INJECTION]: The skill processes user instructions for implementing and reviewing code, which creates a surface for indirect prompt injection.
- Ingestion points: User requests for code implementation, refactoring, or review processed via the agent.
- Boundary markers: The skill uses a structured multi-step execution process (Step 1-3) but does not define explicit delimiters for untrusted user code.
- Capability inventory: The skill has access to
Bash,Read,Write, andEdittools. - Sanitization: There is no explicit sanitization of user-provided code or comments before processing.
Audit Metadata