tanstack-start-client-core-start-core-deployment

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing standard deployment tools and Vite plugins from npm, such as @cloudflare/vite-plugin and @netlify/vite-plugin-tanstack-start. It also references the installation of nitro-nightly via an npm alias to access specific features.- [COMMAND_EXECUTION]: The instructions include shell commands for deployment workflows, including logging into hosting services with wrangler and netlify, and executing application build and start scripts.- [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by showing how to dynamically generate HTML head tags and XML sitemaps using data obtained from external route loaders.
  • Ingestion points: External data is ingested through loaderData in the head metadata function and server handlers in SKILL.md.
  • Boundary markers: No explicit boundary markers or instructions are provided to ensure the agent ignores potentially malicious content within the external data.
  • Capability inventory: The skill's execution context involves network requests (via fetch) and file system operations during the application build process.
  • Sanitization: The examples show direct interpolation of data into meta tags and XML strings, though JSON.stringify is used for JSON-LD scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 10:58 AM