meteor-pubsub
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill content focuses on educating users about secure coding practices in Meteor, specifically highlighting the importance of using
this.userIdfor server-side filtering andfieldsprojections to prevent sensitive data exposure. - [EXTERNAL_DOWNLOADS]: The skill references official technical documentation located in the Meteor organization's GitHub repository. These references are used to provide additional context for publication strategies and the low-level API.
- [INDIRECT_PROMPT_INJECTION]: The
references/eval-cases.mdfile contains sample user prompts designed to test the agent's logic. This constitutes a potential ingestion point for indirect prompt injection; however, the prompts are clearly labeled as test cases and are used to verify the agent's ability to recommend security fixes. - Ingestion points:
references/eval-cases.mdcontains sample prompt strings. - Boundary markers: The test cases are structured with clear headers (e.g.,
## Case 1) and labels (Prompt:), which help the agent distinguish instructions from data. - Capability inventory: The skill body provides instructions for creating Meteor data publications, which interact with database cursors and network protocols (DDP).
- Sanitization: The content is static instructional data intended for agent evaluation.
Audit Metadata