tanstack-ai
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install packages from the official TanStack ecosystem (e.g., @tanstack/ai, @tanstack/ai-react) and Zod. These are well-known libraries from established technology organizations used for their intended development purpose.- [PROMPT_INJECTION]: The skill implements an architecture for handling user messages and tool outputs, which represents an indirect prompt injection surface. It provides robust built-in mitigations for this surface:
- Ingestion points: Untrusted user messages are ingested via API routes defined in app/api/chat/route.ts.
- Boundary markers: Tools are defined using strict Zod schemas in assets/tool-definitions.ts to enforce data structures.
- Capability inventory: The skill manages tools for data fetching (e.g., getWeather) and UI updates (e.g., showToast).
- Sanitization: All tool inputs are validated and sanitized via Zod schemas before being processed by the agent loop or tool implementations.- [COMMAND_EXECUTION]: Includes a utility script scripts/check-ai-env.sh that safely validates the presence of required provider API keys in the environment before starting the application.
Audit Metadata