tanstack
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the official TanStack CLI (
@tanstack/cli) and intent tools (@tanstack/intent) from the npm registry. - [COMMAND_EXECUTION]: The skill executes shell commands using
npxandpnpmto create project structures and install dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill takes user-supplied project names and configuration flags to construct shell commands.
- Ingestion points: User-provided project name and command-line flag overrides (SKILL.md).
- Boundary markers: None specified in the instructions.
- Capability inventory: Shell execution via
npxandpnpm(SKILL.md). - Sanitization: No specific sanitization instructions are provided for the user-supplied input.
Audit Metadata