pubnub-live-auctions
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate implementation patterns for auction features such as bid broadcasting, countdown synchronization, and lifecycle management. It correctly instructs developers to use server-side PubNub Functions for validation rather than trusting client-side input.
- [CREDENTIALS_UNSAFE]: The code snippets use standard placeholders (e.g., 'pub-c-...', 'sub-c-...', 'auth-key') for SDK initialization, which is safe practice for documentation.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the 'pubnub' package from NPM, which is the official library from the verified vendor.
- [INDIRECT_PROMPT_INJECTION]: While the skill describes processing user-submitted bid data, it provides explicit instructions and code for server-side validation, tiered increment enforcement, and idempotency handling to prevent common bidding vulnerabilities.
Audit Metadata