liveblocks-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation reference for Liveblocks integration. All identified external resources, including domains like liveblocks.io and liveblocks.com, and NPM packages starting with @liveblocks/, are official vendor assets belonging to the author.
- [CREDENTIALS_SAFE]: Code examples correctly demonstrate the use of environment variables (e.g.,
process.env.LIVEBLOCKS_SECRET_KEY) for secret management. Placeholder keys provided in examples (e.g.,sk_prod_xxxxxxxxxxxxxxxxxxxxxxxx) are clearly non-functional and intended for illustrative purposes only. - [COMMAND_EXECUTION]: The skill mentions official CLI tools like
npx liveblocks devandnpx create-liveblocks-appfor project initialization and local development. These are standard, well-documented tools for the Liveblocks developer workflow. - [INDIRECT_PROMPT_INJECTION]: The skill describes patterns for ingesting untrusted data (such as user metadata and comment bodies) and rendering it via components like
resolveUsersandComment.Body. However, these are implemented through standard React component patterns that do not expose the agent to injection vulnerabilities during static analysis.
Audit Metadata