typescript-advanced-patterns

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is primarily educational, providing best practices for advanced TypeScript features such as Stage 3 decorators, variadic tuples, and recursive conditional types. It contains no executable code or scripts that perform malicious actions.
  • [INDIRECT_PROMPT_INJECTION]: The skill discusses patterns for ingesting external data, such as route parameters, environment variables, and API payloads, which represents a potential injection surface. However, the skill provides specific remediation guidance to mitigate these risks.
  • Ingestion points: External data enters through route strings (dsl-route-param-inference.md), environment variables (impl-env-config-loader.md), and HTTP request bodies (impl-schema-derived-api-client.md).
  • Boundary markers: The instructions consistently advocate for the use of Zod or Valibot schemas to create strict boundaries for untrusted data.
  • Capability inventory: The skill facilitates static type checking and structural transformations; it does not include capabilities for arbitrary command execution or network exfiltration.
  • Sanitization: The patterns emphasize schema validation, data coercion, and type-level assertions (assertNever) to ensure all data conforms to expected shapes before processing.
  • [EXTERNAL_DOWNLOADS]: The skill references established and trusted libraries and tools, including Zod, Valibot, tRPC, and official TypeScript documentation. These are well-known services and organizations, and their mention is standard for the documented development workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 10:48 AM
Security Audit — agent-trust-hub — typescript-advanced-patterns