Individual skill
adversarial-tanstack
Use this skill to gate TanStack Start plus TypeScript web-app changes with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 22 decidable rules covering client/server boundary leaks, server-function and server-route usage, auth and security, SSR data loading, boundary type safety, and compiler config. Trigger it before merging TanStack Start work, when asked to gate, adversarially review, or pass/fail a Start or TanStack codebase, or as a final check on agent-authored Start features. It renders verdicts only and never fixes the work; for teaching-style review feedback use a distillation skill instead.
skills/.experimental/adversarial-tanstack/SKILL.md
Source commit cf93c57cac89d6fc3e4194686000411567f5caf3
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 5, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 222
- Repository last updated
- Aug 15, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 5,760 bytesSKILL.mdcore · 5,760 bytesassets/templates/verdict.mddoc · 1,461 bytesgotchas.mddoc · 2,381 bytesmetadata.jsonasset · 1,524 bytesreferences/_sections.mddoc · 1,735 bytesreferences/boundary-client-env-prefix.mddoc · 1,320 bytesreferences/boundary-env-server-context.mddoc · 1,918 bytesreferences/boundary-loader-no-secrets.mddoc · 1,445 bytesreferences/reviewer-prompt.mddoc · 3,326 bytesreferences/sec-auth-at-handler.mddoc · 1,668 bytesreferences/sec-csrf-with-custom-start.mddoc · 1,193 bytesreferences/sec-no-account-enumeration.mddoc · 1,784 bytesreferences/sec-private-cache-control.mddoc · 1,547 bytesreferences/sec-session-cookie-flags.mddoc · 1,005 bytesreferences/serverfn-current-api.mddoc · 1,619 bytesreferences/serverfn-post-mutations.mddoc · 1,448 bytesreferences/serverfn-static-imports.mddoc · 1,079 bytesreferences/serverfn-validate-input.mddoc · 1,506 bytesreferences/ssr-deterministic-render.mddoc · 1,573 bytesreferences/ssr-per-request-instances.mddoc · 1,598 bytesreferences/ssr-suspense-for-loader-data.mddoc · 1,483 bytesreferences/tscfg-erasable-syntax.mddoc · 1,538 bytesreferences/tscfg-no-verbatim-module-syntax.mddoc · 1,168 bytesreferences/tscfg-strict-baseline.mddoc · 1,149 bytesreferences/types-exhaustive-switch.mddoc · 1,609 bytesreferences/types-justified-nonnull.mddoc · 1,468 bytesreferences/types-no-escape-hatches.mddoc · 1,621 bytesreferences/types-parse-external-data.mddoc · 1,628 bytes
Read excerpt
# Adversarial TanStack Gate
A merge gate for TanStack Start + TypeScript web-app changes — a pass/fail gate: a single blind reviewer subagent judges the work against this gate's rules with an adversarial mandate, and the work passes only when every rule is PASS or N/A. This skill renders verdicts; it never fixes the work.
Rules are pinned to `@tanstack/react-start` 1.168+ (v1 RC, July 2026) and TypeScript 5.8–6.x semantics.
## When to Apply
- A TanStack Start feature, route, or server function is about to merge and needs an objective PASS/FAIL, not advisory feedback.
- An agent (Claude, Codex) authored Start app code and you want an independent check its author bias cannot rubber-stamp.
- A diff touches the client/server boundary — env vars, loaders, server functions, auth — where a wrong PASS ships secrets or unauthorized data access.
- Auditing an existing Start codebase file set against the current v1 RC API surface (stale `.inputValidator()`, removed `createServerFileRoute`).
Do not apply to non-Start React apps (most `serverfn`/`boundary`/`ssr` rules will return N/A and the gate degenerates to a TypeScript check) or when the user wants explanations and refactors rather than a verdict.