pubnub/pubnub-functions
Create, configure, and deploy PubNub Functions 2.0 event handlers, triggers, and serverless endpoints. Use when building real-time message transformations, PubNub modules, webhook integrations, or edge data processing.
98
100%
Does it follow best practices?
Impact
98%
1.84xAverage score across 10 eval scenarios
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 0.90). The skill's docs and required examples explicitly use the XHR module to fetch external URLs (see references/functions-modules.md and references/functions-patterns.md — e.g., xhr.fetch('https://api.moderation.example.com/check')) and then act on the returned JSON (blocking or allowing messages), so untrusted third-party responses can directly influence runtime decisions.
Where we found it
api.example.com
domain · 4 sites
Documentation example showing XHR GET/POST usage with placeholder domain api.example.com
references/functions-modules.md
96
xhr.fetch('https://api.example.com/data')
references/functions-modules.md
106
xhr.fetch('https://api.example.com/webhook'
references/functions-modules.md
165
xhr.fetch('https://api.example.com/data'
references/functions-modules.md
332
xhr.fetch('https://api.example.com/data'
api.moderation.example.com
domain · 1 site
Documentation example showing content moderation pattern with placeholder domain api.moderation.example.com
references/functions-patterns.md
106
xhr.fetch('https://api.moderation.example.com/check'
api.crm.example.com
domain · 1 site
Documentation example showing CRM webhook integration with placeholder domain api.crm.example.com
references/functions-patterns.md
173
xhr.fetch('https://api.crm.example.com/events'
api.config.example.com
domain · 1 site
Documentation example showing parallel operations with placeholder domain api.config.example.com
references/functions-basics.md
190
xhr.fetch('https://api.config.example.com/settings'
- Audited
- Security analysis