pubnub-live-stock-quote-updates
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows industry standard security practices for managing sensitive information. It utilizes environment variables (e.g.,
process.env.MARKET_DATA_API_KEY) for authentication tokens and emphasizes the use of PubNub Access Manager (grantToken) to enforce server-side data entitlements rather than relying on client-side logic. Examples include placeholders for keys rather than hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture for ingesting and processing external market data from third-party feeds, which represents an indirect prompt injection surface.
- Ingestion points: Untrusted market data enters the system through WebSocket connections and PubNub message listeners in
stock-quotes-setup.mdandportfolio-tracker.js. - Boundary markers: The skill relies on standard JSON parsing to delimit data fields, but does not provide explicit prompt delimiters for text-based fields like ticker news.
- Capability inventory: The skill possesses network transmission capabilities via the PubNub SDK (
pubnub.publish,pubnub.signal,pubnub.fire) and server-side logic execution through PubNub Functions. - Sanitization: The implementation includes a
validateQuotefunction that filters data based on numeric validity (price > 0), timestamp freshness, and logical consistency (bid/ask spread), which serves as a primary layer of defense against malformed or malicious data inputs.
Audit Metadata