realtime-sync
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides comprehensive technical references for real-time synchronization, including WebTransport, CRDTs (Yjs, Automerge), and pub/sub messaging. All architectural patterns and code snippets align with industry best practices for performance and state consistency, and no malicious code or unsafe operations were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill outlines patterns for AI stream orchestration which involves processing live LLM tokens. This represents a potential data ingestion surface, but the risk is assessed as safe because the skill focuses strictly on UI rendering and synchronization rather than command execution. \n
- Ingestion points: Patterns in
references/ai-stream-orchestration.mdingest token data from pub/sub channels. \n - Boundary markers: The provided examples do not use explicit delimiters or isolation markers for the token content. \n
- Capability inventory: The skill's demonstrated capabilities are restricted to UI state updates and animation frame batching; no dangerous system capabilities are exposed to the stream data. \n
- Sanitization: Not explicitly implemented in the transport-layer examples provided.
Audit Metadata