The Agent Skills Directory

[SAFE]: The skill is a comprehensive documentation set for tRPC. Analysis of all components confirms adherence to security best practices.
[PROMPT_INJECTION]: No evidence of prompt injection or behavior override patterns was found in the metadata or instructional text.
[DATA_EXFILTRATION]: No sensitive file paths or unauthorized network exfiltration patterns were detected. Network examples use local or official tRPC/npm domains.
[EXTERNAL_DOWNLOADS]: The skill references official tRPC and npm registries for package installation (e.g., npm install @trpc/server). These are well-known, trusted sources for the library's ecosystem.
[REMOTE_CODE_EXECUTION]: No remote script execution or piped shell commands (e.g., curl | bash) were identified.
[COMMAND_EXECUTION]: Shell examples are limited to standard package manager commands (npm install) and running a provided update script (scripts/check-updates.py).
[DYNAMIC_EXECUTION]: The scripts/check-updates.py script performs version checks against the npm registry and local file integrity checks. It does not ingest untrusted data for execution.
[CREDENTIALS_UNSAFE]: Code examples use placeholders (e.g., my-api-key, Authorization: token ? Bearer ${token} : undefined) and encourage environment variable usage for secrets.
[INDIRECT_PROMPT_INJECTION]: The skill describes procedures for handling user input but mandates the use of Zod or similar validators in all examples to sanitize data at the schema level.

trpc