sveltia-cms
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS] (SAFE): The HTML templates for Hugo, Jekyll, and 11ty reference the Sveltia CMS library from unpkg.com, a standard and trusted CDN for NPM packages. The use of a specific version (0.113.3) prevents unexpected breaking changes or malicious updates from unversioned tags.
- [COMMAND_EXECUTION] (SAFE): The skill includes shell scripts (
init-sveltia.shandcheck-versions.sh) designed for local project initialization and dependency checking. These scripts perform routine file operations and package metadata lookups without dangerous patterns such as piping remote content directly into an interpreter. - [CREDENTIALS_UNSAFE] (SAFE): No hardcoded API keys or secrets are present. The documentation and templates use clear placeholders and explicitly guide users to use secure environment variable management (e.g., Cloudflare Workers secrets) for sensitive OAuth credentials.
- [REMOTE_CODE_EXECUTION] (SAFE): There are no patterns involving the download and immediate execution of untrusted scripts. All script usage is transparent and limited to standard development tools like npm and shell built-ins.
Audit Metadata