{"agent":"claude","input":"Run a security audit on this SvelteKit app without changing anything. Read package.json, pnpm-lock.yaml, svelte.config.js, vite.config.js, src/hooks.server.js, src/lib/api.js, src/app.html and every +page.server.js, +layout.server.js and .svelte file under src/routes first. For each place the app decides who the user is, sets or reads a cookie, renders HTML with {@html}, forwards a token, or passes form data to the API, say what it trusts and whether that trust is checked. Check the cookie options the framework applies when none are passed, whether a Content Security Policy or origin check is configured, which tags and URL schemes the HTML sanitizer's default options allow for article bodies, whether any other user-supplied field reaches {@html}, which API calls are not awaited, and what the register and settings actions echo back or send. Run pnpm audit and list vulnerable packages with their advisories. Write security-audit.md: findings ordered by severity, each with file and line, impact, and a fix written for this codebase, then a dependency section, then what the app already does right. Change no code and open no pull request.","resources":[{"url":"https://github.com/your-org/your-app"}]}