Context-Inappropriate Capability
High
- Confidence
- 94% confidence
- Finding
- Allowing arbitrary JavaScript via `customMapFunction` introduces a code-execution pathway that is unrelated to simple lead discovery and can transform the skill from data retrieval into programmable processing. In agent or automation environments, this can enable malicious logic, unsafe data handling, or abuse of downstream execution contexts if user-controlled code is passed through.
