nuqs
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data from URL search parameters into application logic.
- Ingestion points: URL parameters are processed by hooks and loaders as described in 'references/hooks/useQueryState.md', 'references/hooks/useQueryStates.md', and 'references/server/server-side.md'.
- Boundary markers: The library uses a parser-based architecture to define expected data formats, which acts as a preliminary filter for external data.
- Capability inventory: The skill demonstrates these parameters being used for UI state and server-side fetching in 'samples/server-side-parsing.md'.
- Sanitization: The documentation promotes using type-safe parsers and Zod schema validation to sanitize inputs, as detailed in 'references/parsers/built-in.md'.
- [EXTERNAL_DOWNLOADS]: The skill provides standard instructions for installing the library from public registries.
- Evidence: 'scripts/install.md' lists installation commands for npm, yarn, and pnpm to fetch the 'nuqs' package.
Audit Metadata