tanstack-start-conventions
Warn
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill explicitly instructs users to "Pin zod@4.4.3" in
references/params-search-api-routes.md. Currently, the Zod library is on version 3.x, and version 4.4.3 is not present in the official registry. Recommending a non-existent or future major version of a critical dependency poses a security risk, as it could lead a developer or an automated agent to install a malicious package published under that specific version string by a third party. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for handling external input from API routes and server functions, creating an ingestion surface for untrusted data.
- Ingestion points: Data is ingested via
request.urlsearch parameters in API handlers (routes/api/) and JSON payloads increateServerFnvalidators. - Boundary markers: The instructions focus on Zod schema validation for data structure but do not include guidance for the agent to use delimiters (like triple backticks or XML tags) or safety instructions when processing natural language content found within that data.
- Capability inventory: The skill provides examples of sensitive operations including database mutations (
db.user.update), filesystem reads (fs.readdir), and project configuration involving shell command execution (bun --bunin scripts). - Sanitization: The skill emphasizes structural validation via Zod but lacks specific sanitization logic to prevent malicious instructions embedded in data from influencing agent behavior.
Audit Metadata