tanstack-ai
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx @tanstack/intent@latestto fetch and execute the TanStack Intent CLI tool for project analysis and skill configuration. - [COMMAND_EXECUTION]: Instructions direct the agent to run package management commands (e.g.,
pnpm add,npm install) and Node.js snippets to inspect package versions and repository files. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a router that ingests content from installed packages and external skill files, representing an attack surface for indirect prompt injection if those resources were compromised.
- Ingestion points: Reads files from
node_modules/@tanstackand loads additional skill definitions vianpx @tanstack/intent load. - Boundary markers: The skill does not define specific delimiters for content loaded from external sources.
- Capability inventory: Execution of shell commands (npx, pnpm) and modification of local configuration files (e.g.,
CLAUDE.md,.cursorrules). - Sanitization: No explicit sanitization or validation of the content retrieved from external skill sources is specified in this entry skill.
Audit Metadata