tanstack-router
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several packages from the @tanstack organization and other well-known libraries like zod and valibot. These are standard, widely-used developer tools for the React ecosystem.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for handling untrusted data originating from URL search parameters and path segments.\n
- Ingestion points: Data enters the application context through useSearch, useParams, and beforeLoad hooks (e.g., in references/search-params.md).\n
- Boundary markers: The documentation encourages the use of validation schemas to define strictly allowed data structures.\n
- Capability inventory: The skill demonstrates fetching external data in loaders using network requests and TanStack Query (e.g., in references/data-loading.md).\n
- Sanitization: The skill explicitly teaches best practices for sanitization, recommending the use of zodValidator and valibotValidator to ensure all user-controlled search parameters match expected types and constraints before being processed by the application.\n- [DYNAMIC_EXECUTION]: The skill references the use of the TanStackRouterVite plugin, which performs build-time code generation for the routing tree (routeTree.gen.ts). This is a standard architectural pattern for providing compile-time type safety in React applications and does not involve executing arbitrary code from untrusted runtime sources.
Audit Metadata