pubnub/pubnub-order-delivery-driver
Build real-time order tracking and delivery driver systems with PubNub
91
65%
Does it follow best practices?
Impact
94%
1.84xAverage score across 15 eval scenarios
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 0.80). The skill's code and workflow explicitly subscribe to and load history from PubNub channels (e.g., driver.*.location, order.*.status, chat.order.* and dispatch.order-claims) and use PubNub Functions to read and act on those user-generated messages (e.g., resolving claims, recalculating ETA, republishing sanitized locations or issuing driver commands), meaning untrusted third-party content is ingested at runtime and can materially influence actions.
Where we found it
driver.*.location
domain · 2 sites
The plugin subscribes to driver location channels (driver.*.location) and uses PubNub Functions to read and act on user-generated GPS messages for geofence triggers and privacy filtering, ingesting untrusted driver content at runtime.
references/delivery-patterns.md
409
// PubNub Function: After Publish on driver.*.location
references/delivery-status.md
307
// PubNub Function: After Publish on driver.*.location
order.*.status
domain · 1 site
The plugin deploys a PubNub Function on order.*.status channels to validate state transitions, reading and acting on user-generated status messages from customers, merchants, and drivers.
references/delivery-status.md
159
// PubNub Function: Before Publish on order.*.status
chat.order.*
domain · 6 sites
The plugin subscribes to chat.order.* channels for driver-customer messaging, loading message history and acting on user-generated chat content (text, quick replies, attachments) in real time.
dispatch.order-claims
domain · 2 sites
The plugin uses dispatch.order-claims channel for driver claim messages, with a PubNub Function that resolves conflicting claims (first-write-wins) by reading driverId and orderId from user-generated claim messages.
references/delivery-patterns.md
157
channel: 'dispatch.order-claims',
references/delivery-patterns.md
168
// Deployed as After Publish on dispatch.order-claims
dispatch.new-orders
domain · 2 sites
The plugin subscribes to dispatch.new-orders channel to receive incoming order broadcasts from merchants/systems, which the dispatch system then acts on to assign drivers.
references/delivery-patterns.md
34
channels: ['dispatch.new-orders'],
references/delivery-setup.md
16
| `dispatch.new-orders` | Incoming order broadcast | Available drivers, dispatch system |
dispatch.status-updates
domain · 5 sites
The plugin subscribes to dispatch.status-updates channel to aggregate order status changes from all orders, used by fleet dashboards and dispatch systems to track order progress in real time.
SKILL.md
137
channel: 'dispatch.status-updates',
references/delivery-patterns.md
298
channels: ['dispatch.status-updates'],
306
} else if (event.channel === 'dispatch.status-updates') {
563
channel: 'dispatch.status-updates',
references/delivery-status.md
96
channel: 'dispatch.status-updates',
dispatch.failed-deliveries
domain · 1 site
The plugin publishes to dispatch.failed-deliveries channel when a delivery fails, which the dispatch system consumes to trigger reassignment logic.
references/delivery-status.md
496
channel: 'dispatch.failed-deliveries',
driver.<driverId>.commands
domain · 7 sites
The plugin publishes to driver.<driverId>.commands channel to send instructions (new assignments, claim accept/reject, delivery cancelled) that driver apps subscribe to and act upon.
driver.<driverId>.location
domain · 14 sites
The plugin subscribes to driver.<driverId>.location channels for real-time GPS coordinates from driver apps, used by customer tracking pages and fleet dashboards to render driver position on maps and calculate ETAs.
fleet.<fleetId>.positions
domain · 5 sites
The plugin uses fleet channel groups to aggregate driver location channels for fleet management dashboards, subscribing to all active driver positions.
references/delivery-setup.md
18
| `fleet.<fleetId>.positions` | Aggregated fleet positions | Fleet management dashboard |
29
channelGroup: `fleet-${fleetId}-locations`
37
channelGroup: `fleet-${fleetId}-locations`
44
channelGroups: ['fleet-main-locations']
references/delivery-patterns.md
297
channelGroups: [`fleet-${this.fleetId}-locations`]
order.<orderId>.status
domain · 29 sites
The plugin subscribes to order.<orderId>.status channels for order lifecycle updates from customers, merchants, and drivers, used by tracking pages, dispatch systems, and status validation functions.
order.<orderId>.driver-location
domain · 3 sites
The plugin uses a PubNub Function to republish sanitized driver locations to order.<orderId>.driver-location channels, which customers subscribe to for privacy-filtered location updates.
references/delivery-patterns.md
451
channel: `order.${delivery.orderId}.driver-location`,
references/delivery-patterns.md
481
channels: [`order.${orderId}.driver-location`]
references/delivery-patterns.md
486
if (event.channel === `order.${orderId}.driver-location`) {
dispatch.available-orders
domain · 1 site
The plugin publishes to dispatch.available-orders channel for broadcast-and-claim dispatch, where drivers subscribe to see and claim available orders.
references/delivery-patterns.md
141
channel: 'dispatch.available-orders',
drivers.available
domain · 1 site
The plugin uses presence on drivers.available channel to track driver online/offline status, which the dispatch system uses to know which drivers are available for assignment.
references/delivery-setup.md
508
3. **Set up presence for driver availability.** Use PubNub presence events (`join`, `leave`, `timeout`) on a shared `drivers.available` channel to know which dr
dispatch.assignments
domain · 1 site
The plugin documents dispatch.assignments channel for driver assignment confirmations that dispatch dashboards and assigned drivers would subscribe to.
references/delivery-setup.md
17
| `dispatch.assignments` | Driver assignment confirmations | Dispatch dashboard, assigned driver |
- Audited
- Security analysis