The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines several ingestion points for untrusted data, including request bodies (request.json()), form data (request.formData()), and URL parameters. It mitigates injection risks by strictly enforcing the use of Zod schemas for input validation via .inputValidator() or safeParse(). It explicitly lists 'Not validating input' as a common mistake.
[COMMAND_EXECUTION]: The skill provides examples of file system operations using node:fs/promises's writeFile function within API routes and server functions for file uploads. The provided code demonstrates proper sanitization by implementing file size limits (5MB) and MIME type filtering (image/jpeg, image/png, image/webp) before writing to the ./uploads/ directory.
[DATA_EXPOSURE_AND_EXFILTRATION]: Documentation includes patterns for handling sensitive environment variables such as SECRET_API_KEY and STRIPE_WEBHOOK_SECRET. The framework's createServerOnlyFn is utilized to ensure this data remains on the server and is never bundled into client-side code, preventing accidental exposure. The skill also provides authenticated patterns using @oakoss/auth/server to restrict data access based on session state.
[EXTERNAL_DOWNLOADS]: The skill utilizes several Node.js packages including @tanstack/react-start, @tanstack/react-router, and libraries from the @oakoss organization. These are standard dependencies for the framework and the author's ecosystem, used for routing, authentication, and database integration.

tanstack-start