oRPC Publisher

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and installs several packages including @orpc/experimental-publisher, ioredis, and @upstash/redis. These are well-known libraries or vendor-specific resources for the oRPC project.
  • [PROMPT_INJECTION]: The skill establishes an architectural pattern for processing external event payloads from sources like Redis or Cloudflare. This creates a surface for indirect prompt injection if payloads contain instructions targeting the agent.
  • Ingestion points: Event payload yielded in SKILL.md asynchronously.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are demonstrated in the snippets.
  • Capability inventory: The skill yields event data directly into the agent's processing context.
  • Sanitization: No explicit sanitization of the event data is shown in the usage examples.
  • [SAFE]: No evidence of credential theft, obfuscation, or unauthorized network activity was found.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 10:49 PM
Security Audit — agent-trust-hub — oRPC Publisher