tanstack-ai-vue-skilld

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFENO_CODE
Full Analysis
  • [SAFE]: The skill functions as a documentation resource for developers using the TanStack AI Vue integration. All code snippets demonstrate standard, legitimate usage of the library's reactive hooks and transport adapters.
  • [NO_CODE]: The skill contains no executable code or automation scripts. It is composed of markdown files providing usage rules, API definitions, and integration examples for external Vue applications.
  • [INDIRECT_PROMPT_INJECTION]: The documentation describes the library's surface area for processing untrusted model outputs and tool results. It explicitly recommends security measures for developers to mitigate injection-related risks.
  • Ingestion points: Reactive state managed by useChat and media generation hooks (useTranscription, useSummarize) which process data from AI providers.
  • Boundary markers: Relies on the standard message structures of the underlying @tanstack/ai-client library.
  • Capability inventory: Capabilities are limited to network communication via SSE/HTTP and the execution of developer-defined client tools.
  • Sanitization: The skill advises developers to use highlighters (e.g., @tanstack/highlight/markdown) that escape source text before it is rendered as HTML to prevent Cross-Site Scripting (XSS).
  • [DATA_EXFILTRATION]: The skill documents 'Bring Your Own Key' (BYOK) functionality. It notes that sensitive API keys are handled by a dedicated ByokClient and transmitted via secure x-byok-* headers rather than in request bodies, following industry security standards for client-side key management.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 07:46 AM