svelte-code-writer
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- EXTERNAL_DOWNLOADS (LOW): The skill utilizes
bunxto download and execute the@sveltejs/mcppackage. This is an external dependency from an organization not included in the pre-approved trusted list. The severity is lowered because the package is core to the skill's stated Svelte-specific functionality. - COMMAND_EXECUTION (LOW): The
svelte-autofixertool accepts code snippets or file paths as command-line arguments. This pattern is susceptible to command injection if the input is not carefully sanitized, particularly when using shell runners likebunx. - PROMPT_INJECTION (LOW): The skill demonstrates a surface for indirect prompt injection. 1. Ingestion points:
svelte-autofixerinput in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Command execution via bunx. 4. Sanitization: No automated sanitization is present; the skill relies on manual user escaping of characters.
Audit Metadata