docs-features
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides core documentation features, such as callouts and heading collection, within the TanStack ecosystem. No malicious behaviors or safety guideline violations were detected during analysis.- [EXTERNAL_DOWNLOADS]: The skill references and depends on official packages from the TanStack organization, specifically @tanstack/markdown and @tanstack/highlight. These are legitimate resources that align with the skill's purpose and author.- [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes untrusted Markdown content to generate metadata and HTML.
- Ingestion points: The
parseMarkdownandrenderHtmlfunctions ingest raw markdown source strings. - Boundary markers: The skill utilizes specific comment-based delimiters such as
<!-- ::start:tabs -->to scope processing. - Capability inventory: The skill transforms markdown into structured JSON metadata and HTML custom elements.
- Sanitization: According to the documentation, JSON-serialized properties are escaped during HTML rendering to prevent attribute-based injection.
Audit Metadata