reachpad.dev

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The manifest.secrets and manifest.services fields let a published function app read organization secrets and reach external services, while the file content can be arbitrary JavaScript exporting a fetch handler. If an agent is induced (e.g. by injected instructions elsewhere in a conversation or in fetched content) to publish such a function, it could exfiltrate secrets or other data to attacker-controlled endpoints under the guise of a normal app publish. Given the broad blast radius, this deserves extra caution/confirmation before secrets/services are attached to a manifest.

update_app carries the same manifest.secrets/services capability as create_app, meaning an existing app can be silently upgraded (especially via mode:merge or publish:false staging) to a function with access to organization secrets and outbound network calls, without necessarily showing the user the new capability being added.