testland/azure-functions-tests
Runs Azure Functions locally using Azure Functions Core Tools v4 (`func start`), Azurite storage emulation, and framework-native unit tests for handler code (.NET isolated worker model, Node.js v4, Python v2). Covers HTTP, queue, and timer trigger testing, admin-endpoint invocation for non-HTTP triggers, and binding verification via local.settings.json. Use when testing Azure Functions before deployment, reproducing trigger behaviour without live Azure services, or gating function handler logic in CI.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The runtime workflow is the local Azure Functions host started with `func start` plus an admin endpoint that accepts POSTed JSON payloads for queue/timer triggers (e.g., `http://localhost:7071/admin/functions/<name>`), meaning outsider-authored request body text can be ingested directly into the functions under test.
Where we found it
localhost:7071
domain · 6 sites
The scanner flags localhost:7071 as an ingestion point for outsider-authored content via the admin endpoint, but this is the user's own local Azure Functions development server receiving user-crafted test payloads.
- Audited
- Security analysis