tanstack-devtools-event-client-devtools-bidirectional

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill promotes secure development by advising that devtools plugins be conditionally disabled in production environments and by using structuredClone to prevent side effects from shared object references. No malicious code or exfiltration patterns were detected.
  • [PROMPT_INJECTION]: The skill describes a managed surface for indirect data ingestion where devtools commands can influence application state.
  • Ingestion points: Application event listeners for 'revert' and 'set-state' events in SKILL.md ingest payloads from the event bus.
  • Boundary markers: The implementation patterns do not include explicit schema validation or boundary markers for incoming event payloads.
  • Capability inventory: The application is configured to mutate its internal state based on event data received from the devtools interface.
  • Sanitization: Payload data is applied to the application state without specific sanitization or filtering logic, which is typical for development-time tooling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 10:57 AM