query-layer
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides architectural patterns and documentation for managing a data query layer using TanStack Query and Wellcrafted factories. No malicious code, obfuscation, or persistence mechanisms were found.
- [EXTERNAL_DOWNLOADS]: The documentation references official resources for TanStack Query, including its GitHub repository and the @tanstack/svelte-query package. These are well-known, industry-standard resources.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture that handles data from external services, creating an attack surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context via service functions (e.g., in $lib/queries) called by query factories.
- Boundary markers: The skill mandates the use of Result objects (Ok/Err) and tagged errors to strictly separate data from error states, which helps prevent misinterpretation of service outputs.
- Capability inventory: The query layer is restricted to cache management and reactive UI updates using TanStack Query; no dangerous shell execution, file system writes, or arbitrary network capabilities are exposed to this layer.
- Sanitization: Data is passed through to the UI boundary where presentation-layer skills (e.g., svelte, error-handling) manage the final rendering and reporting.
Audit Metadata