tanstack-better-upload
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing dependencies from the npm registry, specifically
@better-upload/server,@better-upload/client, andreact-dropzone. These packages are necessary for the library's functionality and are sourced from standard registries. - [COMMAND_EXECUTION]: The documentation includes standard package management commands (
bun add) for setup andnpx shadcnfor component installation. These are typical developer workflows and are used as intended for environment configuration. - [DATA_EXPOSURE]: The skill correctly handles sensitive information by recommending the use of environment variables for S3 credentials (
S3_UPLOAD_KEY,S3_UPLOAD_SECRET) and providing guidance on secure S3 CORS configurations to limit access to trusted origins. - [SAFE]: The skill actively promotes secure coding practices by:
- Recommending server-side validation of file metadata and types using Zod in the
onBeforeUploadhook. - Instructing users to sanitize object keys (filenames) to prevent path traversal attacks.
- Ensuring authentication is enforced in server-side handlers before generating presigned URLs.
Audit Metadata