tanstack-query-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building applications that fetch and process external data, which is an inherent attack surface for indirect prompt injection if that data contains malicious instructions targeting the AI agent or the application.
- Ingestion points: The skill describes fetching data from external APIs via
fetchoraxiosin multiple files (e.g.,qk-include-dependencies.md,query-cancellation.md). - Boundary markers: None explicitly defined for user-provided data in the instructions.
- Capability inventory: The agent using this skill can generate application code capable of network operations and state management.
- Sanitization: The skill mentions using a safe serializer instead of
JSON.stringifyto prevent XSS inssr-dehydration.md. - [SAFE]: The skill uses well-known and reputable libraries and follows established best practices for React development. No evidence of credential theft, obfuscation, or malicious command execution was found.
Audit Metadata