nuqs
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a documentation resource for the
nuqslibrary. It provides patterns for managing URL state with built-in type safety and validation, which is a defensive programming practice. No malicious patterns, obfuscation, or unauthorized access attempts were detected in the provided instructions or code samples. - [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for handling URL search parameters, which are untrusted external inputs. It mitigates injection risks by strongly recommending the use of typed parsers and schema validation libraries (like Zod or ArkType) to sanitize and validate all incoming query data.
- Ingestion points: URL parameters ingested via
useQueryState,useQueryStates,createLoader, andcreateSearchParamsCache(found inSKILL.mdandreferences/server-create-loader.md). - Boundary markers: Documentation emphasizes defining explicit parser contracts and using validation schemas to enforce data boundaries.
- Capability inventory: The skill is restricted to React state management and URL manipulation; it does not utilize sensitive system capabilities like file system access or network requests.
- Sanitization: Input is sanitized through typed parsers that convert strings to specific domain types or fall back to safe defaults.
Audit Metadata