shiny-ble-hubs
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building P2P communication systems that ingest data from potentially untrusted remote Bluetooth peripherals.
- Ingestion points: Data is received through GATT characteristic writes and L2CAP binary streams, specifically via the Receive method in IBleHubMediaChannel as documented in the API reference.
- Boundary markers: While structured hub calls utilize JsonSerializerContext for delimited data, the raw packet pipes (Media Channels) lack built-in boundary markers or explicit instructions for handling malicious payloads.
- Capability inventory: The skill enables generated code to perform file system write operations through the EnableFileTransfers and DownloadFile methods, utilizing paths like FileSystem.AppDataDirectory.
- Sanitization: The skill does not prescribe specific input validation or sanitization patterns for raw data received over L2CAP media channels.
Audit Metadata