tanstack-start
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical manual for the TanStack Start framework. It contains documentation and code examples intended to assist developers in building full-stack React applications.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing data from external sources, such as fetching from third-party APIs (e.g., TMDB in
references/getting-started/tutorial-fetching-external-api.md) and rendering remote markdown (e.g., from GitHub inreferences/auth-data-styling/rendering-markdown.md). While these represent ingestion points for untrusted data, the skill provides specific and effective remediation guidance: - Sanitization: Recommends using
rehype-sanitizewhen rendering untrusted markdown to prevent XSS. - Validation: Strongly encourages the use of
zodfor runtime schema validation on all server functions (references/server/server-functions.md). - Boundaries: Explicitly warns against leaking server-side secrets to the client bundle and provides environment-control APIs (
createServerOnlyFn) to enforce these boundaries. - [COMMAND_EXECUTION]: The skill references various CLI tools and scripts (
npx,wrangler,netlify,gitpick) for project scaffolding, local development, and deployment. These are standard, well-known tools within the React and TanStack ecosystems used for legitimate development workflows. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading project templates and dependencies from trusted organizations, specifically from official TanStack repositories on GitHub and partner platforms like Cloudflare and Netlify.
Audit Metadata