velt-crdt-best-practices
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a comprehensive collection of best practices for implementing real-time collaboration using Velt's SDK and CRDT technology.- [EXTERNAL_DOWNLOADS]: The documentation recommends installing official NPM packages from the @veltdev, @tiptap, @blocknote, and @xyflow organizations to support collaboration features.- [COMMAND_EXECUTION]: The rule files include example
curlcommands for interacting with Velt's REST APIs atapi.velt.devfor server-side data management tasks like retrieving or updating collaborative content.- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the development of applications that process multi-user collaborative data, which represents an indirect prompt injection surface. - Ingestion points: Data enters the agent context through methods such as
useVeltCrdtStore,createVeltStore, and theuseCrdtEventCallback("updateData")event listener. - Boundary markers: The provided code snippets do not implement specific boundary markers or instructions to ignore embedded commands within the synchronized CRDT data.
- Capability inventory: The skill demonstrates capabilities for package management (
npm install) and network requests to vendor APIs (curl). - Sanitization: The documentation focuses on synchronization logic and does not currently include specific guidance on sanitizing or validating the content of the collaborative data streams.
Audit Metadata