pubnub-order-delivery-driver
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill demonstrates implementation using the official
pubnubSDK and references vendor documentation. These resources are legitimate and essential for the skill's stated purpose.\n- [DATA_EXFILTRATION]: Data transmission is restricted to the PubNub platform for real-time messaging purposes. The skill does not access sensitive system files (e.g., SSH keys, environment files) or attempt to transmit data to unauthorized external domains.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines an architecture for processing real-time data from external PubNub channels, including chat and status messages. This constitutes a potential vulnerability surface for indirect prompt injection if the agent were to process these messages as instructions.\n - Ingestion points: Use of
pubnub.addListenerinreferences/delivery-setup.mdandreferences/delivery-patterns.mdto capture external message events.\n - Boundary markers: The skill enforces separation of concerns through specific channel naming conventions, isolating high-frequency telemetry from critical status updates.\n
- Capability inventory: SDK functions for publish/subscribe and PubNub Functions for server-side validation and geofencing.\n
- Sanitization: Includes specific methods for sanitizing location data in
references/delivery-patterns.mdto protect driver privacy.
Audit Metadata