skills/lukasa1993/tanstack-skills-extracted/tanstack-cli-maintain-custom-addons-dev-watch/Gen Agent Trust Hub
tanstack-cli-maintain-custom-addons-dev-watch
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute the
@tanstack/clipackage vianpx. This is a standard method for using the official TanStack command-line tools for application scaffolding and add-on development. - [INDIRECT_PROMPT_INJECTION]: The skill documents the
--dev-watchfeature, which monitors a user-specified local directory for changes. This represents a data ingestion surface where the agent could potentially process untrusted content if the directory contains malicious files. - Ingestion points: Local file system paths (e.g.,
../path/to/framework-dir) provided to the CLI via the--dev-watchflag inSKILL.md. - Boundary markers: None provided in the skill instructions to delimit content within the watched directory.
- Capability inventory: Execution of shell commands and project initialization via
npx @tanstack/cli. - Sanitization: The skill relies on the built-in validation and handling logic of the
@tanstack/clitool.
Audit Metadata