nuqs
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for managing state via URL parameters, which constitutes an ingestion point for untrusted external data.
- Ingestion points: URL search parameters are ingested into the application context using
useQueryState,useQueryStates, andcreateSearchParamsCacheas described inSKILL.md. - Boundary markers: The skill advocates for the use of built-in parsers (e.g.,
parseAsInteger,parseAsString) andcreateParserwhich provide type-safe validation and serve as boundary delimiters. - Capability inventory: The skill body and provided code snippets do not include high-risk capabilities such as file system writes, network requests, or arbitrary command execution.
- Sanitization: The library's parsing mechanism acts as a sanitization layer, though the application remains responsible for how the resulting values are used downstream.
Audit Metadata