The Agent Skills Directory

[SAFE]: The instructions correctly advise against exposing secrets via client-side environment variable prefixes (VITE_ or PUBLIC_) and provide guidance on secure server-side access to environment variables.
[SAFE]: Detailed guidance is provided for implementing CSRF protection when using custom entry points, which is a critical security measure for RPC-style server functions.
[SAFE]: The skill emphasizes the importance of server-side validation and authorization within .handler() and middleware, reinforcing that client-side checks are insufficient for securing data boundaries.
[SAFE]: External dependencies and scaffolding commands (e.g., npx @tanstack/cli, npx gitpick) point to official framework resources and well-known repositories.
[SAFE]: Guidance on Cache-Control headers correctly identifies the risks of using public caching for identity-dependent content and recommends secure alternatives like private or no-store.

tanstack-start