bubble-io-plugins
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a development framework for Bubble.io plugins, focusing on project structure, code quality, and platform-specific constraints.
- [DATA_EXPOSURE]: The instructions explicitly mandate the use of server-side actions for handling API keys and secrets via
context.keys, and strictly forbid placing credentials in client-side code, which aligns with security best practices. - [DYNAMIC_EXECUTION]: The coding standards documentation explicitly forbids the use of dynamic execution functions such as
eval(),new Function(), andsetTimeoutwith string arguments to prevent code injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill identifies the risk of processing user-supplied data (Bubble properties) and provides clear mitigation strategies, including the use of
textContentoverinnerHTMLand sanitization of input before insertion to prevent Cross-Site Scripting (XSS). - [EXTERNAL_DOWNLOADS]: The templates provided in the skill use well-known, trusted CDNs (e.g., jsdelivr) for library loading and employ idempotent loading patterns to ensure security and stability during plugin execution.
Audit Metadata