SvelteKit WebApp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:26 PM UTC
• Version: 1.1.1

Overview

This SvelteKit builder is not obviously malicious, but it needs review because it can run mutable third-party install tools and push or deploy generated code with unclear production boundaries.

Before installing, be comfortable with an agent running package managers, creating repos, and deploying apps. Pin or approve exact tool versions, run scaffolding in an isolated workspace, review diffs before commits and pushes, protect the main branch, and require a separate deployment approval gate for production.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-42; references/cli-commands.md:40-41; references/scaffold-stories.md:29-40, 70-73, 109, 165; references/pwa-config.md:6; references/deployment.md:11, 54, 79, 87, 115, 163
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:39-42:

markdown

| `sv` | SvelteKit scaffolding | `npm i -g sv` (or use via `pnpx`) |
| `pnpm` | Package manager | `npm i -g pnpm` |
| `gh` | GitHub repo creation | [cli.github.com](https://cli.github.com) |
| `vercel` | Deployment | `npm i -g vercel` |

references/cli-commands.md:40-41:

bash

pnpx sv create [name]   # Scaffold project
pnpx sv add [addon]     # Add functionality

references/scaffold-stories.md:29-40:

bash

# 1. Create project (use pnpx if pnpm available, else npx)
pnpx sv create [project-name] \
  --template minimal \
  --types ts

cd [project-name]

# 2. Add core add-ons
pnpx sv add eslint prettier mcp mdsvex tailwindcss vitest playwright

# 3. Install dependencies
pnpm install

references/scaffold-stories.md:70-73:

bash

# Install Skeleton (Svelte 5 version)
pnpm add @skeletonlabs/skeleton @skeletonlabs/skeleton-svelte

# Install Bits UI for headless primitives
pnpm add bits-ui

references/scaffold-stories.md:109:

bash

pnpm add -D vite-plugin-pwa

references/scaffold-stories.md:165:

bash

pnpm add -D @tailwindcss/typography @tailwindcss/forms

references/pwa-config.md:6:

bash

npm install -D vite-plugin-pwa

references/deployment.md:11, 54, 79, 87, 115, 163:

bash

npx sv add sveltekit-adapter

bash

npx sv add sveltekit-adapter  # choose: cloudflare, target: pages

bash

npx wrangler pages deploy .svelte-kit/cloudflare

bash

npx sv add sveltekit-adapter  # choose: netlify

text

Install the Net
...[truncated 2981 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every directly executed package to an exact reviewed version, for example pnpx sv@X.Y.Z and npx wrangler@X.Y.Z.
2. Pin project dependencies to exact versions rather than floating ranges where practical.
3. Generate and commit the appropriate lockfile, then use frozen or immutable installation modes in automated workflows.
4. Prefer project-local development dependencies over global installations.
5. Maintain an allowlist of approved package names, versions, registries, and integrity hashes.
6. Verify package provenance, signatures, integrity metadata, maintainer history, and registry origin before upgrading.
7. Review dependency changes and lifecycle scripts before executing newly resolved versions.
8. Use --ignore-scripts during installation where lifecycle scripts are unnecessary, enabling only specifically reviewed scripts afterward.
9. Run package installation and scaffolding in an isolated workspace or container with minimal filesystem access and no unrelated credentials.
10. Keep deployment credentials narrowly scoped and avoid exposing them to dependency installation or build steps unless required.
11. Add automated dependency scanning and lockfile review to CI.
12. Document an explicit upgrade process so pinned versions are updated only after security review and testing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/scaffold-stories.md (reported line 180)May include surrounding context.

md

"acceptanceCriteria": [
    ".env.example created with all required variables",
    ".env.example added to git",
    ".env added to .gitignore",
    "Variables documented with comments",
    "Type definitions added to src/app.d.ts for $env module"
  ],

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The invocation guidance includes broad triggers like 'build me an app/site/webapp', which can overlap with ordinary requests and cause the skill to activate in more situations than intended. Because this skill has access to exec, Write, Edit, and browser, overbroad activation increases the chance of unexpected code generation, dependency installation, or deployment-oriented actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This duplicate finding points to the same unpinned npx sv reference. Unpinned package execution allows arbitrary upstream code changes to enter the build path, which is especially risky for an agent skill that scaffolds projects by executing commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The story sequence explicitly includes pnpx sv create with fallback npx sv, again relying on runtime package resolution instead of a pinned, reviewed version. This creates a repeatable supply-chain exposure across executions of the skill, not just a documentation-only issue.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The handoff text states that pushing to main auto-deploys to Vercel, enabling a direct path from repository changes to production deployment. In the context of an agent-driven skill, this increases the impact of mistakes or unsafe generated changes because a routine push can trigger external side effects without a separate deployment approval gate.

Content

Scanner excerpt · SKILL.md (reported line 642)May include surrounding context.

md

## Deployment

Push to `main` branch → auto-deploys to Vercel.

## Troubleshooting

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

pnpx sv create [name] executes a package resolver/fetch path without pinning an exact version, so the agent may run whatever the latest published sv package is at execution time. In an agent skill that scaffolds projects automatically, this creates a supply-chain risk: a compromised upstream release, typo/confusion package, or breaking change could lead to arbitrary code execution or unsafe project generation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

pnpx sv add [addon] similarly relies on an unpinned package/tool invocation, allowing remote code from the currently resolved package version to run during addon installation. Because this skill is intended to be used by an agent to build apps, the unpinned invocation is more dangerous than a passive example: it can directly affect the generated codebase and execute install-time scripts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

This quick-reference entry repeats the same unsafe guidance by documenting pnpx sv create [name] without a pinned version. Although this line is reference text rather than the primary procedural step, it reinforces insecure operator behavior and increases the chance the agent or user will execute an unpinned remote package.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

This quick-reference entry repeats the unpinned pnpx sv add [addon] pattern, preserving the same supply-chain and arbitrary-code-execution risk if copied verbatim. Even as documentation, it is security-relevant because users and agents commonly rely on quick-reference sections for direct command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation instructs users to execute npx sv without pinning an exact package version. Because npx resolves and may download the latest package at runtime, a compromised upstream release or breaking change could cause execution of unexpected code in the developer environment. In a scaffolding/deployment skill, this is more dangerous because users are likely to run these commands verbatim during project setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This instance again recommends npx sv without a pinned version, creating the same supply-chain risk of pulling and executing whatever version is current at the time. Since the file is a deployment guide, readers may assume the command is trustworthy and run it in environments with access to source code and credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

npx wrangler is referenced without pinning a specific version, which can result in downloading and executing an unreviewed release. Because Wrangler is a deployment tool that may interact with Cloudflare accounts and tokens, an unexpected or malicious version could affect build outputs or misuse credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The unpinned npx sv command exposes users to the same package substitution and upstream compromise risks as the other occurrences. In the context of a webapp scaffolding skill, this pattern is especially risky because it normalizes running network-fetched tooling during sensitive setup and deployment stages.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command again instructs execution of npx sv without version pinning, making builds non-reproducible and exposing the user to arbitrary upstream changes. For deployment/setup documentation, this can directly impact developer machines and CI runners that follow the guide.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The final npx sv occurrence has the same supply-chain and reproducibility issues: it may fetch and execute the latest package code at runtime. Given this skill is intended to scaffold production-ready apps, users are likely to trust and automate these commands, increasing exposure if the upstream package is compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/deployment.md (reported line 198)May include surrounding context.

md

## CI/CD with GitHub Actions

### Vercel (via GitHub integration) — Recommended
No GitHub Action needed—Vercel auto-deploys on push when connected:
- **Push to `main`** → Production deployment
- **Push to `dev`** → Preview at `[project]-git-dev-[team].vercel.app`
- **Push to any branch** → Preview at `[project]-git-[branch]-[team].vercel.app`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt explicitly instructs the agent to commit all changes automatically once checks pass, without requiring a user confirmation step before modifying repository history. In an autonomous coding agent, this can cause unauthorized or premature commits, including committing unintended, sensitive, or incomplete changes, especially because the instruction says to commit ALL changes rather than a narrowly reviewed diff.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The environment template includes secret-bearing variables such as OAuth client secrets but does not include handling guidance, storage expectations, or explicit warnings not to commit real values. In a scaffolding skill, this omission is risky because it can normalize insecure secret handling early in project setup and lead to accidental exposure through commits, logs, screenshots, or copy/paste into wrong files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.