The Agent Skills Directory

[SAFE]: The skill consists of educational markdown files providing architectural guidance and code snippets for TanStack Start applications. No executable scripts, binaries, or active command-line instructions are included within the skill package.
[CREDENTIALS_UNSAFE]: While code examples mention environment variables like SESSION_SECRET and STRIPE_SECRET_KEY, these are used as placeholders for configuration and do not contain hardcoded secrets or sensitive credentials. The instructions correctly advocate for storing such secrets in .env files, which is a standard and recommended practice.
[EXTERNAL_DOWNLOADS]: The skill does not perform any remote downloads or fetch external content at runtime. References to well-known services like Stripe are illustrative and do not involve untrusted network operations.
[PROMPT_INJECTION]: The instructions are clearly structured as developer guidelines and do not contain patterns intended to bypass AI safety filters or override system instructions.
[OBFUSCATION]: All content is provided in clear, human-readable markdown and standard TypeScript/React code. There is no evidence of Base64 encoding, hidden characters, or homoglyph attacks.
[DYNAMIC_CONTEXT_INJECTION]: The skill does not use dynamic command execution placeholders (like exclamation-backtick syntax) that would run shell commands at skill load time.

tanstack-start-best-practices