tanstack-ai-vue-skilld
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill functions as a documentation resource for developers using the TanStack AI Vue integration. All code snippets demonstrate standard, legitimate usage of the library's reactive hooks and transport adapters.
- [NO_CODE]: The skill contains no executable code or automation scripts. It is composed of markdown files providing usage rules, API definitions, and integration examples for external Vue applications.
- [INDIRECT_PROMPT_INJECTION]: The documentation describes the library's surface area for processing untrusted model outputs and tool results. It explicitly recommends security measures for developers to mitigate injection-related risks.
- Ingestion points: Reactive state managed by
useChatand media generation hooks (useTranscription,useSummarize) which process data from AI providers. - Boundary markers: Relies on the standard message structures of the underlying
@tanstack/ai-clientlibrary. - Capability inventory: Capabilities are limited to network communication via SSE/HTTP and the execution of developer-defined client tools.
- Sanitization: The skill advises developers to use highlighters (e.g.,
@tanstack/highlight/markdown) that escape source text before it is rendered as HTML to prevent Cross-Site Scripting (XSS). - [DATA_EXFILTRATION]: The skill documents 'Bring Your Own Key' (BYOK) functionality. It notes that sensitive API keys are handled by a dedicated
ByokClientand transmitted via securex-byok-*headers rather than in request bodies, following industry security standards for client-side key management.
Audit Metadata