The Agent Skills Directory

[SAFE]: The skill provides security-positive instructions, specifically regarding input validation in rules/sf-validation.md. It mandates the use of .inputValidator() for all server functions to prevent processing untrusted data and explicitly warns against trusting client-supplied fields like roles or permissions.
[SAFE]: Guidance on sensitive data handling is provided in rules/deployment.md, which explicitly warns developers to never expose secrets in VITE_-prefixed environment variables, a common pitfall in full-stack development.
[SAFE]: All identified dependencies are well-known, legitimate packages from established ecosystems (TanStack, Vite, Zod, Cloudflare, Netlify). No suspicious or obfuscated external references were found.
[SAFE]: Authentication patterns described in rules/auth-patterns.md follow industry standards, including the use of route guards (beforeLoad), secure session management, and proper handling of CSRF tokens and cookies during header forwarding.

tanstack-start