web-routing-tanstack-router
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill documents the use of TanStack Router, a standard and legitimate library for React applications. The instructions and code examples align with the library's intended purpose and official documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing external data via URL parameters, which is a common attack surface for indirect prompt injection if not handled correctly.
- Ingestion points: Path parameters (e.g., $postId) and search parameters are ingested via useParams() and useSearch() as described in SKILL.md and examples/search-params.md.
- Boundary markers: Not explicitly defined for UI output, but the routing logic itself is bounded by the route tree.
- Capability inventory: Route loaders execute network requests (fetchPosts, apiClient.getPost) and navigation logic (navigate, redirect) based on these inputs.
- Sanitization: The skill mitigates risks by requiring strict schema validation using zodValidator or custom validation functions, ensuring that ingested data matches expected types and constraints before processing.
- [DYNAMIC_EXECUTION]: The skill references the @tanstack/router-plugin, which performs build-time code generation of the routeTree.gen.ts file. This is a standard optimization and type-safety feature of the library and does not involve the execution of arbitrary or untrusted code at runtime.
Audit Metadata