web-data-fetching-trpc
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documentation follows industry-standard security practices for web development. It provides patterns for authenticated procedures and validated inputs that effectively mitigate common API vulnerabilities. All external dependencies mentioned, such as tRPC and TanStack Query, are well-known, legitimate libraries.
- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting external data through tRPC procedure inputs, which is an inherent attack surface for indirect prompt injection. However, it mandates strong defensive measures.
- Ingestion points: Procedure inputs defined in
examples/core.md,examples/file-uploads.md, andexamples/infinite-queries.md. - Boundary markers: The skill requires Zod schemas for every procedure that accepts input, providing strict boundary enforcement.
- Capability inventory: Procedure handlers demonstrate capabilities for database CRUD operations (via
ctx.db) and file storage uploads. - Sanitization: All inputs are validated against Zod schemas before being processed, and authorization is enforced via context-narrowing middleware (e.g.,
protectedProcedure) prior to handler execution.
Audit Metadata