meteor-pubsub

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill content focuses on educating users about secure coding practices in Meteor, specifically highlighting the importance of using this.userId for server-side filtering and fields projections to prevent sensitive data exposure.
  • [EXTERNAL_DOWNLOADS]: The skill references official technical documentation located in the Meteor organization's GitHub repository. These references are used to provide additional context for publication strategies and the low-level API.
  • [INDIRECT_PROMPT_INJECTION]: The references/eval-cases.md file contains sample user prompts designed to test the agent's logic. This constitutes a potential ingestion point for indirect prompt injection; however, the prompts are clearly labeled as test cases and are used to verify the agent's ability to recommend security fixes.
  • Ingestion points: references/eval-cases.md contains sample prompt strings.
  • Boundary markers: The test cases are structured with clear headers (e.g., ## Case 1) and labels (Prompt:), which help the agent distinguish instructions from data.
  • Capability inventory: The skill body provides instructions for creating Meteor data publications, which interact with database cursors and network protocols (DDP).
  • Sanitization: The content is static instructional data intended for agent evaluation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 12:45 PM