A load function that returns { stripeKey: STRIPE_SECRET_KEY } sends your Stripe secret key to every visitor inside the page data, and csrf: { checkOrigin: false } lets any website submit your forms with your users' cookies. This skill finds those and nine other SvelteKit mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on svelte.config.js, vite.config, .svelte components, +page, +layout and +server files, hooks, remote functions, src/env.ts and .env files. It knows SvelteKit 2 and 3: it reads the @sveltejs/kit version from package.json, knows that redirect() in SvelteKit 3 refuses external URLs unless you allow them, that cookies.set() makes cookies httpOnly and secure by default, which modules are server-only, and that SvelteKit stops adding its CSP nonces when 'unsafe-inline' is in script-src. It follows URL, form and load data through variables, $derived and {#each} blocks, skips comments, and treats DOMPurify.sanitize() and similar calls as cleaned. It never builds or runs the app. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• K01: secret-named variables made public (secret, password, private key, service role, database URL, chat webhook URL, AI and GitHub tokens): PUBLIC_ names in .env files and public env imports, VITE_ names in import.meta.env, and public: true in src/env.ts
• K02: csrf.checkOrigin: false or '*' in csrf.trustedOrigins, written there or in a constant array
• K03: CORS that copies the request's Origin into Access-Control-Allow-Origin together with Allow-Credentials: true
• K04: secrets sent to the browser: private env values that server load functions, form actions or remote functions return (directly or in a local object), secret keys written in .svelte files, universal load or src/lib modules outside server folders, and process.env copied into the bundle by vite define. Browser keys such as publishable, anon, search-only and PostHog keys are not reported
• K05: {@html} with a value from the URL (search params, hash, route params), also when it is set in $effect or onMount; values only compared with or looked up by the URL are not counted

REVIEW (check before release)

• K11: {@html} with load data, form results or component props and no sanitizer
• K12: open redirects to query-string or form values through redirect(), a Location header or window.location, without a same-origin check (a startsWith('/') test alone does not count)
• K13: session or auth cookies with httpOnly or secure turned off, sameSite none, set by the cookie package's serialize() or stringifySetCookie() without httpOnly, a raw Set-Cookie header or document.cookie
• K14: 'unsafe-inline' or 'unsafe-eval' in the CSP script-src (report-only policies and 'unsafe-inline' next to 'strict-dynamic' are not reported)
• K15: the server handleError hook, or a handler it wraps, returning error messages or stack traces
• K16: Access-Control-Allow-Origin: * together with Allow-Credentials: true

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official documentation link for each rule
• A risky and a safe example SvelteKit project, and the real report the scanner produces on the risky one

Limits

It reads each file on its own: a value passed through a function in another file, a secret imported from a shared module, or a sanitizer applied in another component is not followed. A custom kit.env.publicPrefix is not read (PUBLIC_ is assumed), and authorization inside load functions and actions, remote function input validation, and security headers set by a proxy or host are not checked. Without a package.json that lists @sveltejs/kit, redirects are judged by SvelteKit 2 rules. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 28 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (20 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.