There are a couple of things I'm not quite sure about: * Prompting. I think it's reasonable in this case, but not everyone agrees.
You don't want to prompt the user to accept the device or not. The user plugged it in and wants to use it. The purpose of the prompt I suggested is to discover whether the device claims to be the thing it looks like it is.
* How broad is the "simple HID" category? Is it always safe to accept these devices?
No it's not safe, see https://hakshop.myshopify.com/collections/usb-rubber-ducky/products/usb-rubber-ducky-deluxe
Attachment:
signature.asc
Description: This is a digitally signed message part