The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill documentation in SKILL.md and references/project-setup.md provides commands to scaffold projects using npx @tanstack/cli@latest and npx gitpick. These operations fetch resources from official and well-known framework repositories, which is standard for modern development workflows.
[DATA_EXPOSURE]: In references/common-mistakes.md, the skill proactively includes security guidance regarding the 'isomorphic' nature of TanStack Start loaders. It explicitly warns against including sensitive data like process.env.SECRET in client-accessible code and demonstrates the secure pattern of using createServerFn to encapsulate server-only logic.
[COMMAND_EXECUTION]: The agent workflow in SKILL.md specifies the use of fuse-ai-pilot:sniper for verification. This is an instruction to use an internal agent tool as part of a development lifecycle and does not represent a malicious execution pattern.
[SAFE]: The project templates and configuration files (package.json, tsconfig.json, vite.config.ts) follow industry best practices, including disabling verbatimModuleSyntax to prevent unintentional code leakage.

start-core