Skills
Navigate
skills/lukasa1993/tanstack-skills-extracted/tanstack-markdown-octane-rendering/Gen Agent Trust Hub

tanstack-markdown-octane-rendering

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown content via the source parameter in several components (e.g., Article, UserPost). This creates an attack surface where external data could potentially contain malicious instructions intended for the agent.
  • Ingestion points: The source property passed to the Markdown component in SKILL.md.
  • Boundary markers: Not explicitly defined in the provided code snippets.
  • Capability inventory: Markdown parsing and conversion into Octane descriptors or static SSR markup.
  • Sanitization: The documentation includes a security warning stating that TanStack Markdown does not sanitize raw HTML when the allowHtml option is enabled.
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructs the user to install external Node.js packages to utilize the functionality.
  • Evidence: pnpm add @tanstack/markdown octane in SKILL.md.
  • Note: The specified packages are well-known libraries within the development ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 06:38 AM