bmob-cloud-function-development
Fail
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references documentation and raw configuration files from official repositories on GitHub for the purpose of developer guidance.
- [COMMAND_EXECUTION]: The agent is instructed to use file system operations to write source code retrieved from the Bmob cloud into local project directories like
cloudfunctions/during synchronization tasks. - [PROMPT_INJECTION]: The skill establishes an ingestion surface by reading code from the
get_cloud_functionAPI and writing it to local disk. While no explicit sanitization is described, this behavior is central to the skill's function and operates within the context of the user's Bmob account. - [SAFE]: The domain
api.codenow.cnis a legitimate Bmob service endpoint and is used in a negative instruction context to discourage insecure API usage patterns.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata