query-docs-library-metadata
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
@tanstack/clicommands vianpxto query library metadata, search documentation, and list project add-ons. - [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto fetch and execute the@tanstack/clipackage from the npm registry, which is a resource managed by the skill's author. - [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation content and search results which could theoretically contain malicious instructions.
- Ingestion points: Data retrieved from documentation pages and search snippets via the
docandsearch-docscommands. - Boundary markers: None explicitly defined in the prompt templates.
- Capability inventory: Shell command execution via
npxand potential filesystem interactions for project scaffolding. - Sanitization: The skill relies on machine-readable JSON output provided by the CLI tool to normalize data structures.
Audit Metadata