pubnub-live-voting
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external participants (voter IDs and option selections) via the
poll.<pollId>.voteschannel. This data is ingested into the agent context for tallying and result broadcasting. The skill mitigates this by enforcing server-side validation using PubNub Before Publish Functions, validating option IDs against a pre-defined list, and using KV Store to prevent duplicate submissions. While the ingestion surface exists, the implementation focuses on structured data processing and atomic increments. - [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration were detected. All code examples use standard PubNub SDK patterns, and external references are limited to the vendor's own documentation and infrastructure.
Audit Metadata