The Agent Skills Directory

[SAFE]: The skill focuses on secure development practices, specifically warning that route-level guards (beforeLoad) do not protect RPC endpoints and that authorization must be enforced inside the handler or middleware.
[SAFE]: Dependencies such as @tanstack/react-start and zod are well-known, industry-standard libraries for React development and TanStack frameworks.
[COMMAND_EXECUTION]: The agent workflow mentions executing fuse-ai-pilot:sniper. This is a vendor-specific tool (associated with the author 'fusengine') used for verifying code changes and is not considered a security risk in this context.
[INDIRECT_PROMPT_INJECTION]: While the skill defines how to ingest untrusted data from the client, it provides robust mitigation guidance.
Ingestion points: createServerFn validator and handler parameters in SKILL.md and creating.md.
Boundary markers: The skill highlights that strict serialization is active by default and encourages explicit Zod schemas.
Capability inventory: Database access and server-side secret management are isolated to .server.ts files and protected handlers.
Sanitization: Mandatory Zod validation is prescribed for all user-supplied data crossing the network boundary.
[SAFE]: The documentation includes detailed advice on preventing cross-tenant data leaks by using appropriate Cache-Control headers for authenticated responses.

start-server-functions