lov-install-tanstack-query
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as
find,rg(ripgrep), and package managers includingnpm,pnpm,yarn, andbunto analyze project structure and manage dependencies. These actions are appropriate for the skill's stated purpose of project refactoring. - [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of well-known, official libraries from the standard NPM registry (@tanstack/react-query). These references target recognized industry services and do not escalate the security risk.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local data by reading project source files,
package.json, andAGENTS.md. 1. Ingestion points: Project source code and local documentation files. 2. Boundary markers: No specific delimiters or warnings were found. 3. Capability inventory: Package installation and file modification/refactoring. 4. Sanitization: No explicit sanitization logic was detected. While this creates a potential surface for indirect prompt injection, it is a functional requirement for coding assistants and represents a low risk in this context.
Audit Metadata