TanStack Libraries

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

This skill is a TanStack reference guide with purpose-aligned documentation and command examples, but users should treat its unpinned npm/npx examples as normal supply-chain risk.

Before running the npm or npx examples, prefer project-local installs with a lockfile, pin package versions for reproducibility, and avoid running scaffolding or diagnostics in directories that contain sensitive credentials unless you trust the package source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/tooling.md:37

Finding

Unpinned npm Packages Are Installed or Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: references/tooling.md:37-38 and references/tooling.md:51
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

npm i -g @tanstack/cli
npx @tanstack/cli create

bash

npx @tanstack/intent doctor

Technical Analysis

These instructions resolve package versions dynamically from the configured npm registry. The npx commands may download and immediately execute package code, while the global installation makes the resolved CLI persist in the user's environment. No version constraint, lockfile, package integrity value, or provenance-verification step is provided.

The package names are consistent with the Skill's declared TanStack documentation purpose, and the audit found no evidence that these packages are currently malicious or that the names are typosquatted. Nevertheless, executing an unpinned package creates a supply-chain trust boundary: the code ultimately run may differ from the code reviewed when the Skill was published.

Attack Path

1. An attacker compromises the relevant npm publisher account, package release process, registry response, or a future package version.
2. The attacker publishes a malicious version under the package name referenced by the Skill.
3. A user follows the unpinned npm or npx instruction.
4. npm resolves the attacker-controlled version and may execute installation lifecycle scripts or the requested CLI entry point.
5. The malicious code operates with the permissions and environment available to the invoking user.

Impact Assessment

A compromised package could execute arbitrary code with the invoking user's privileges. Depending on that user's environment, this could expose project files, source code, accessible credentials, environment variables, package-manager tokens, and network resources. It could also modify files or install additional user-leve ...[truncated 300 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every executable package to a reviewed exact version, for example npx @tanstack/cli@<reviewed-version> create.
• Prefer project-local development dependencies over global installation.
• Commit and enforce a lockfile so package versions and transitive dependencies remain reproducible.
• Invoke locally installed binaries through package scripts or npm exec --offline after an audited installation.
• Verify package provenance, publisher identity, release signatures or attestations, and registry integrity metadata before execution.
• Disable installation lifecycle scripts where they are unnecessary, such as with npm install --ignore-scripts, after confirming that the package functions correctly under that restriction.
• Run scaffolding and diagnostic tools in a minimally privileged environment without sensitive credentials.
• Document that users should review generated files and package changes before executing or committing them.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation condition is broad enough that the skill may trigger for a wide range of TanStack-related questions, causing over-selection relative to more specialized skills. This is not a code-execution issue, but it can increase the chance of inappropriate routing, lower-quality answers, or accidental exposure of unnecessary internal reference content in multi-skill environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx @tanstack/cli create without a pinned version causes the latest package version to be fetched and executed at runtime. If the package is ever compromised, maliciously republished, or unexpectedly changed, users following the documentation may execute unreviewed code on their systems.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command npx @tanstack/intent doctor executes an unpinned package version, which means documentation readers may download and run whatever version is current at the time. In a security-sensitive context involving agent skills and diagnostics, this increases supply-chain risk because execution happens directly from registry content rather than a locked dependency.

Content

No source excerpt is available for this finding.