typescript-advanced-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is primarily educational, providing best practices for advanced TypeScript features such as Stage 3 decorators, variadic tuples, and recursive conditional types. It contains no executable code or scripts that perform malicious actions.
- [INDIRECT_PROMPT_INJECTION]: The skill discusses patterns for ingesting external data, such as route parameters, environment variables, and API payloads, which represents a potential injection surface. However, the skill provides specific remediation guidance to mitigate these risks.
- Ingestion points: External data enters through route strings (
dsl-route-param-inference.md), environment variables (impl-env-config-loader.md), and HTTP request bodies (impl-schema-derived-api-client.md). - Boundary markers: The instructions consistently advocate for the use of Zod or Valibot schemas to create strict boundaries for untrusted data.
- Capability inventory: The skill facilitates static type checking and structural transformations; it does not include capabilities for arbitrary command execution or network exfiltration.
- Sanitization: The patterns emphasize schema validation, data coercion, and type-level assertions (
assertNever) to ensure all data conforms to expected shapes before processing. - [EXTERNAL_DOWNLOADS]: The skill references established and trusted libraries and tools, including Zod, Valibot, tRPC, and official TypeScript documentation. These are well-known services and organizations, and their mention is standard for the documented development workflows.
Audit Metadata