Skills
Navigate
skills/tanstack/markdown/react-rendering/Gen Agent Trust Hub

react-rendering

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external markdown strings through the source prop in React components. If this input originates from untrusted users, it could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: The source parameter in the Article and UserPost component examples in SKILL.md.
  • Boundary markers: None explicitly shown in the code snippets, though the skill documentation references external security guides.
  • Capability inventory: Performs React rendering and server-side rendering (SSR) using the @tanstack/markdown/react library.
  • Sanitization: The skill explicitly warns against enabling raw HTML (allowHtml) for untrusted input, which prevents typical XSS and rendering bypass attacks.
  • [EXTERNAL_DOWNLOADS]: The skill references documentation and source code from TanStack's official GitHub repository.
  • Evidence: References to github.com/TanStack/markdown for guides, references, and core logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:53 AM