Skills trpc-scaffolder
📦
trpc-scaffolder
Content revision r2 Critical 📁 Filesystem access⚙️ External commands
Scaffold Type-Safe tRPC Endpoints
Manual tRPC setup creates repetitive router, schema, and registration work. This skill scaffolds consistent tRPC and Zod structures and checks basic project integration.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "trpc-scaffolder" from https://skillstore.io/skills/ariegoldkin-trpc-scaffolder.md and its manifest at https://skillstore.io/api/skills/ariegoldkin-trpc-scaffolder/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "trpc-scaffolder". Create a user router.
Expected outcome:
- A user router file with a typed procedure placeholder.
- Registration and schema follow-up steps.
Using "trpc-scaffolder". Create schemas for a paginated question list.
Expected outcome:
- Input schema guidance for limit and cursor values.
- Output schema guidance for questions and the next cursor.
- Inferred type export guidance.
Using "trpc-scaffolder". Validate the current tRPC setup.
Expected outcome:
A report of discovered routers, missing registration entries, schema files, and missing type exports.
Security Audit
Criticalv9 • 7/23/2026 Open versioned report
Most static alerts are documentation syntax, relative imports, fixed project paths, or safe local validation commands. However, unescaped sed programs permit command execution, and unvalidated names permit path traversal. Public profile examples also omit authorization, and one error example exposes upstream details.
13
Files scanned
1,611
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (4)
Critical
Sed command injection in file generators
Router and entity names are embedded directly into sed programs. Delimiters and newlines can inject sed commands, including GNU sed commands that execute a shell.
The replacement values are unescaped inside dynamically constructed sed expressions. A harmless local reproduction confirmed that an injected sed e command executes.
High
Unvalidated names permit path traversal
Router and entity names are inserted into filesystem paths without validation. Crafted names can escape expected directories, create TypeScript files elsewhere, or probe existing files.
The scripts preserve path separators from CLI arguments and concatenate the resulting values into paths. No allowlist, canonicalization, or containment check is present.
High
Public profile procedures lack authorization
The recommended router exposes profile reads and updates through publicProcedure using caller-supplied userId values. No session or ownership check prevents cross-user access.
Both procedures use publicProcedure and trust input.userId. The update path checks only record existence before modifying the selected profile.
Medium
Upstream error details exposed to clients
The error-handling example returns an upstream service error message through TRPCError. Provider details, request data, or operational information could reach clients.
The example directly interpolates error.message into the client-facing TRPCError message. External API errors commonly include sensitive operational details.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Shell command substitution
PROCEDURE_CODE=$(sed -e "s/{{PROCEDURE_NAME}}/${PROCEDURE_NAME}/g" \
The command substitution runs sed with an unescaped procedure name embedded in its program. A crafted name containing delimiters and sed commands can invoke GNU sed's shell-execution feature.
Critical
Unix shell invocation
#!/bin/bash
This shebang launches a shell script that embeds user-controlled procedure names into a dynamic sed program on lines 53-59. Crafted arguments can execute commands with the user's privileges.
Critical
Unix shell invocation
#!/bin/bash
This shebang launches a generator that embeds an unvalidated router name into sed programs and output paths. Crafted arguments can execute commands or create files outside the router directory.
Critical
Unix shell invocation
#!/bin/bash
This shebang launches a generator that embeds an unvalidated entity name into sed programs and output paths. Crafted arguments can execute commands or create files outside the schema directory.
Risk Factors
📁 Filesystem access (37)
docs/quick-start-guide.md:91 docs/quick-start-guide.md:284 docs/quick-start-guide.md:285 docs/quick-start-guide.md:24 docs/quick-start-guide.md:80 docs/quick-start-guide.md:139 docs/quick-start-guide.md:207 docs/quick-start-guide.md:231 docs/trpc-patterns.md:167 docs/trpc-patterns.md:69 docs/trpc-patterns.md:73 examples/good-router.ts:22 examples/good-router.ts:28 examples/good-schema.ts:122 README.md:16 README.md:19 README.md:22 README.md:25 scripts/add-procedure.sh:35 scripts/add-procedure.sh:36 scripts/add-procedure.sh:42 scripts/create-router.sh:25 scripts/create-router.sh:26 scripts/create-router.sh:63 scripts/create-schema.sh:27 scripts/create-schema.sh:65 scripts/create-schema.sh:28 scripts/create-schema.sh:67 scripts/validate-trpc.sh:15 scripts/validate-trpc.sh:34 scripts/validate-trpc.sh:78 SKILL.md:69 SKILL.md:76 SKILL.md:82 SKILL.md:88 templates/router.ts.template:10 templates/router.ts.template:14
⚙️ External commands (50)
docs/trpc-patterns.md:208-231 docs/trpc-patterns.md:250-267 examples/good-router.ts:55 scripts/add-procedure.sh:25 scripts/add-procedure.sh:26 scripts/add-procedure.sh:35 scripts/add-procedure.sh:53-59 scripts/add-procedure.sh:1 scripts/create-router.sh:21 scripts/create-router.sh:22 scripts/create-router.sh:25 scripts/create-router.sh:1 scripts/create-schema.sh:22 scripts/create-schema.sh:23 scripts/create-schema.sh:24 scripts/create-schema.sh:27 scripts/create-schema.sh:1 scripts/validate-trpc.sh:15 scripts/validate-trpc.sh:34 scripts/validate-trpc.sh:53 scripts/validate-trpc.sh:78 scripts/validate-trpc.sh:88 scripts/validate-trpc.sh:1 SKILL.md:11 SKILL.md:26-33 SKILL.md:33-36 SKILL.md:36-43 SKILL.md:43-46 SKILL.md:46-52 SKILL.md:52-55 SKILL.md:55-61 SKILL.md:61-68 SKILL.md:68-72 SKILL.md:72-75 SKILL.md:75-78 SKILL.md:78-81 SKILL.md:81-84 SKILL.md:84-87 SKILL.md:87-90 SKILL.md:90-99 SKILL.md:99-100 SKILL.md:100-105 SKILL.md:105-106 SKILL.md:106-107 SKILL.md:107-108 SKILL.md:108-109 SKILL.md:109-110 SKILL.md:110-111 SKILL.md:111-114 SKILL.md:114
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/ariegoldkin-trpc-scaffolder/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/ariegoldkin-trpc-scaffolder?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/ariegoldkin-trpc-scaffolder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ariegoldkin-trpc-scaffolder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/ariegoldkin-trpc-scaffolder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
ArieGoldkin. (2026). trpc-scaffolder security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ariegoldkin-trpc-scaffolder/audits/9BibTeX citation
@techreport{ariegoldkin-ariegoldkin-trpc-scaffolder-2026,
author = {ArieGoldkin},
title = {trpc-scaffolder security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/ariegoldkin-trpc-scaffolder/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "trpc-scaffolder security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "ArieGoldkin"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/ariegoldkin-trpc-scaffolder/audits/9"
identifiers:
- type: other
value: "skillstore:ariegoldkin-trpc-scaffolder:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 59
Architecture
85
Maintainability
87
Content
71
Community
83
Spec Compliance
What You Can Build
Create a feature router
Generate a router skeleton and registration guidance for a new application domain.
Define endpoint contracts
Create Zod input and output schema structures before implementing server behavior.
Review tRPC consistency
Check router registration, exported schema types, naming, authorization, and validation patterns.
Try These Prompts
Create a schema
Create a Zod schema for [entity] with these fields: [fields]. Export inferred input and output types.
Add a procedure
Add a [query or mutation] named [procedure] to [router]. Define its input, output, and required error cases.
Scaffold a complete feature
Scaffold [feature] with a router, Zod schemas, procedures, registration steps, and validation. Use protected procedures for sensitive operations.
Review an existing tRPC module
Review [module path] for schema coverage, authorization, error disclosure, registration, pagination, and tests. Propose focused corrections before editing.
Best Practices
- Replace every generated placeholder before using an endpoint.
- Use protected procedures and ownership checks for sensitive data.
- Run validation, TypeScript checks, and tests after scaffolding.
Avoid
- Do not pass untrusted or unvalidated names to the bundled scripts.
- Do not expose account reads or mutations through public procedures.
- Do not treat the validation script as a complete build or security check.
Frequently Asked Questions
Does this install tRPC or Zod?
No. The project must already include tRPC, Zod, and the expected directory structure.
Does the router generator update _app.ts?
No. It creates the router file and prints manual registration steps.
Does the procedure script edit an existing router?
No. It prints a procedure snippet for manual review and insertion.
Can it generate protected procedures?
The templates use public procedures by default. Replace them and add authorization checks for sensitive operations.
What does validation check?
It checks router files, registration patterns, schema files, and inferred type exports.
Which names are safe for the scripts?
Until validation is added, use simple identifiers that start with a letter and contain only letters or numbers.
Developer Details
Author
ArieGoldkinLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
89edfdc710d0846129dcee6a929477b04f08052c
Maintenance freshness
7/24/2026
Usage
7 downloads · 234 views
File structure