tanstack-start-guide
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a legitimate technical guide designed to assist developers in building full-stack React applications. No malicious patterns, obfuscation, or persistence mechanisms were detected.
- [EXTERNAL_DOWNLOADS]: The skill references project initialization commands (e.g.,
pnpm create @tanstack/start) and example cloning from the official TanStack GitHub repository (github.com/tanstack/router). These are trusted sources for the framework's ecosystem. - [CREDENTIALS_UNSAFE]: The documentation includes explicit security warnings against exposing secrets to the client. It demonstrates correct usage of environment variables (e.g.,
SESSION_SECRET) and recommends usingcreateServerFnto keep sensitive logic on the server. All code examples use generic placeholders or local development values. - [INDIRECT_PROMPT_INJECTION]: The skill describes a pattern for fetching and rendering dynamic Markdown content from GitHub. While this introduces a data ingestion surface, the guide suggests standard processing pipelines (e.g.,
unified,remark,rehype) and structured data patterns that follow established developer workflows.
Audit Metadata