tanstack-data-loading
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npxto execute the@tanstack/intentCLI tool, which retrieves and runs code from the npm registry to provide version-specific guidance for the TanStack framework. - [EXTERNAL_DOWNLOADS]: The skill fetches the
@tanstack/intentpackage and potentially other documentation from the TanStack organization's repositories when determining version-specific rules. - [COMMAND_EXECUTION]: The skill executes local Python scripts via
uv runto manage a discovery cache and uses theripgreputility to perform static code analysis on the project's source files. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-provided source code. While this constitutes an indirect prompt injection surface, the skill implements structured discovery and provides manual review instructions to mitigate risk.
- [PERSISTENCE]: The skill maintains application metadata in a local cache file located at
.draekien/tanstack-data-loading/discovery.json. The instructions explicitly direct the agent to obtain user permission before creating the.draekien/directory.
Audit Metadata