pubnub-live-sport-updates
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow for subscribing to and processing messages from external sports data providers. This creates a surface for indirect prompt injection if malicious data from a provider is processed by the agent without sufficient sanitization.\n
- Ingestion points: The skill uses
pubnub.addListenerto handle message events from remote channels inSKILL.mdandreferences/sport-updates-setup.md.\n - Boundary markers: The provided code snippets do not demonstrate the use of delimiters or specific instructions to ignore embedded commands when processing message payloads.\n
- Capability inventory: The skill uses network operations to communicate with the PubNub service (publish/subscribe) and modifies user metadata via the PubNub Objects API.\n
- Sanitization: While
references/sport-updates-events.mdincludes avalidateGameEventfunction, it is limited to schema and type validation rather than content filtering or sanitization.\n- [EXTERNAL_DOWNLOADS]: The documentation instructs users to install the PubNub SDK from the official NPM registry.\n - Evidence:
npm install pubnubinreferences/sport-updates-setup.md.\n- [COMMAND_EXECUTION]: The setup guide includes standard shell commands for managing dependencies using NPM or Yarn.\n - Evidence:
npm install pubnubandyarn add pubnubinreferences/sport-updates-setup.md.
Audit Metadata