📦
Audit History
mcp-apps-builder - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v4 Latest | Jul 6, 2026, 06:13 PM | No confirmed findings | 0 | No capability change |
| v3 | Jul 6, 2026, 06:13 PM | No confirmed findings | 0 | No capability change |
| v2 | Jun 30, 2026, 08:11 AM | No confirmed findings | 0 | Network accessExternal commandsFilesystem accessEnv variablesContains scripts |
| v1 | Feb 24, 2026, 08:58 AM | No confirmed findings | 0 | Baseline |
Audit version 4 Latest
Jul 6, 2026, 06:13 PM
Static analysis reported many severe patterns, but contextual review found them in Markdown documentation, examples, relative links, and placeholder configuration. No confirmed malicious intent, credential exfiltration, prompt-injection attempt, or runnable hidden behavior was found. The main residual risk is that users may copy example commands, network calls, or environment variable handling without adapting them safely.
20
Files scanned
8,688
Lines analyzed
5
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (230)
references/authentication/custom.md:142-156 references/authentication/custom.md:165-169 references/authentication/custom.md:169-170 references/authentication/custom.md:170-171 references/authentication/custom.md:171-172 references/authentication/custom.md:172-175 references/authentication/custom.md:175-178 references/authentication/custom.md:187-191 references/authentication/custom.md:191-192 references/authentication/custom.md:192-193 references/authentication/custom.md:193-194 references/authentication/custom.md:194-197 references/authentication/custom.md:197-206 references/authentication/overview.md:58-59 references/authentication/overview.md:59-61 references/authentication/overview.md:155-160 references/authentication/overview.md:160-166 references/authentication/supabase.md:137-140 references/authentication/supabase.md:140-147 references/authentication/supabase.md:147-153 references/authentication/workos.md:160-163 references/authentication/workos.md:163-170 references/authentication/workos.md:170-176 references/foundations/architecture.md:30-33 references/foundations/architecture.md:159-170 references/foundations/architecture.md:187-190 references/foundations/architecture.md:230-232 references/foundations/concepts.md:41-43 references/foundations/quickstart.md:116-121 references/foundations/quickstart.md:160-164 references/foundations/quickstart.md:164-168 references/foundations/quickstart.md:195-207 references/patterns/common-patterns.md:736-742 references/patterns/common-patterns.md:51-62 references/patterns/common-patterns.md:62-81 references/patterns/common-patterns.md:188-211 references/patterns/common-patterns.md:211-229 references/patterns/common-patterns.md:229-234 references/patterns/common-patterns.md:234-254 references/patterns/common-patterns.md:254-259 references/patterns/common-patterns.md:259-264 references/patterns/common-patterns.md:352-384 references/patterns/common-patterns.md:384-428 references/patterns/common-patterns.md:502-508 references/patterns/common-patterns.md:575-586 references/patterns/common-patterns.md:586-602 references/patterns/common-patterns.md:602-609 references/patterns/common-patterns.md:609-656 references/patterns/common-patterns.md:705-709 references/patterns/common-patterns.md:709-722 references/patterns/common-patterns.md:722-726 references/patterns/common-patterns.md:743-756 references/patterns/common-patterns.md:756-760 references/server/prompts.md:30-33 references/server/prompts.md:33-34 references/server/prompts.md:34-35 references/server/prompts.md:35-36 references/server/prompts.md:36-37 references/server/prompts.md:37-38 references/server/prompts.md:38-39 references/server/prompts.md:39-43 references/server/prompts.md:123-124 references/server/prompts.md:124-125 references/server/prompts.md:125-126 references/server/prompts.md:126-127 references/server/prompts.md:127-128 references/server/prompts.md:128-129 references/server/prompts.md:129-133 references/server/prompts.md:161-162 references/server/prompts.md:162-163 references/server/prompts.md:163-167 references/server/prompts.md:184-185 references/server/prompts.md:185-186 references/server/prompts.md:186-187 references/server/prompts.md:187-191 references/server/prompts.md:213-216 references/server/prompts.md:216-219 references/server/prompts.md:219-224 references/server/prompts.md:279-282 references/server/prompts.md:302-305 references/server/prompts.md:305-306 references/server/prompts.md:306-307 references/server/prompts.md:307-308 references/server/prompts.md:308-310 references/server/prompts.md:310-311 references/server/prompts.md:311-312 references/server/prompts.md:312-313 references/server/prompts.md:313-319 references/server/prompts.md:360-361 references/server/prompts.md:361-362 references/server/prompts.md:362-363 references/server/prompts.md:363-367 references/server/prompts.md:394-395 references/server/prompts.md:395-396 references/server/prompts.md:396-397 references/server/prompts.md:397-398 references/server/prompts.md:398-399 references/server/prompts.md:399-400 references/server/prompts.md:400-401 references/server/prompts.md:401-405 references/server/prompts.md:426-428 references/server/prompts.md:451-453 references/server/prompts.md:475-476 references/server/prompts.md:476-477 references/server/prompts.md:477-478 references/server/prompts.md:478-479 references/server/prompts.md:479-480 references/server/prompts.md:480-481 references/server/prompts.md:481-483 references/server/prompts.md:489-490 references/server/prompts.md:490-491 references/server/prompts.md:491-493 references/server/prompts.md:522-533 references/server/prompts.md:559-562 references/server/prompts.md:562-565 references/server/prompts.md:565-581 references/server/prompts.md:605-610 references/server/resources.md:131-133 references/server/resources.md:209-220 references/server/resources.md:315-318 references/server/resources.md:318-321 references/server/resources.md:486-494 references/server/response-helpers.md:47-64 references/server/response-helpers.md:64-65 references/server/response-helpers.md:65-66 references/server/response-helpers.md:66-70 references/server/response-helpers.md:155 references/server/response-helpers.md:159-167 references/server/response-helpers.md:171 references/server/response-helpers.md:173 references/server/response-helpers.md:179 references/server/response-helpers.md:183-186 references/server/response-helpers.md:218-230 references/server/response-helpers.md:255-261 references/server/response-helpers.md:261-274 references/server/response-helpers.md:274-285 references/server/response-helpers.md:324-328 references/server/response-helpers.md:358-360 references/server/response-helpers.md:360-372 references/server/response-helpers.md:372-381 references/server/response-helpers.md:402-403 references/server/response-helpers.md:403-407 references/server/response-helpers.md:430-432 references/server/response-helpers.md:476-492 references/server/response-helpers.md:504-515 references/server/response-helpers.md:515-533 references/server/response-helpers.md:533-552 references/server/response-helpers.md:552-558 references/server/response-helpers.md:586-587 references/server/response-helpers.md:587-589 references/server/response-helpers.md:593-595 references/server/tools.md:35-38 references/server/tools.md:110-113 references/server/tools.md:141-144 references/server/tools.md:144-149 references/server/tools.md:149-157 references/server/tools.md:181-191 references/server/tools.md:191-196 references/server/tools.md:235-239 references/server/tools.md:311-317 references/server/tools.md:348-368 references/widgets/advanced.md:204-233 references/widgets/basics.md:63-67 references/widgets/basics.md:664-670 references/widgets/interactivity.md:107-110 references/widgets/interactivity.md:180-183 references/widgets/interactivity.md:469-472 references/widgets/interactivity.md:548-554 references/widgets/interactivity.md:637-647 references/widgets/interactivity.md:684-694 references/widgets/state.md:164-176 references/widgets/ui-guidelines.md:74-80 references/widgets/ui-guidelines.md:120-127 references/widgets/ui-guidelines.md:142-148 references/widgets/ui-guidelines.md:193-205 references/widgets/ui-guidelines.md:238-261 references/widgets/ui-guidelines.md:321-357 references/widgets/ui-guidelines.md:376-391 references/widgets/ui-guidelines.md:434-435 references/widgets/ui-guidelines.md:435-445 references/widgets/ui-guidelines.md:456-458 references/widgets/ui-guidelines.md:512-518 references/widgets/ui-guidelines.md:703-722 references/widgets/ui-guidelines.md:722-753 SKILL.md:38 SKILL.md:40-51 SKILL.md:51-53 SKILL.md:53 SKILL.md:59-63 SKILL.md:63-89 SKILL.md:89-90 SKILL.md:90-123 SKILL.md:123 SKILL.md:132 SKILL.md:136 SKILL.md:140-144 SKILL.md:144 SKILL.md:163-186 SKILL.md:186-206 SKILL.md:206 SKILL.md:207-211 SKILL.md:211-212 SKILL.md:212-215 SKILL.md:215 SKILL.md:216-218 SKILL.md:218-219 SKILL.md:219 SKILL.md:220-222 SKILL.md:222-226 SKILL.md:226 SKILL.md:228-242 SKILL.md:242-243 SKILL.md:243 SKILL.md:247 SKILL.md:248-252 SKILL.md:252 SKILL.md:253 SKILL.md:255 SKILL.md:256-258 SKILL.md:258-282 SKILL.md:282-302 SKILL.md:302-322 SKILL.md:322-330 SKILL.md:330 SKILL.md:331 SKILL.md:332 SKILL.md:333 SKILL.md:334 SKILL.md:335 SKILL.md:336
🌐 Network access (50)
references/authentication/custom.md:141 references/authentication/custom.md:14 references/authentication/custom.md:21 references/authentication/custom.md:22 references/authentication/custom.md:23 references/authentication/custom.md:24 references/authentication/custom.md:27 references/authentication/custom.md:52 references/authentication/custom.md:53 references/authentication/custom.md:54 references/authentication/custom.md:55 references/authentication/custom.md:84 references/authentication/custom.md:89 references/authentication/custom.md:135 references/authentication/custom.md:136 references/authentication/custom.md:137 references/authentication/custom.md:138 references/authentication/custom.md:141 references/authentication/custom.md:165 references/authentication/custom.md:169 references/authentication/custom.md:170 references/authentication/custom.md:171 references/authentication/custom.md:172 references/authentication/custom.md:175 references/authentication/custom.md:187 references/authentication/custom.md:191 references/authentication/custom.md:192 references/authentication/custom.md:193 references/authentication/custom.md:194 references/authentication/custom.md:197 references/authentication/overview.md:153 references/authentication/overview.md:153 references/authentication/supabase.md:136 references/authentication/supabase.md:137 references/authentication/workos.md:159 references/authentication/workos.md:160 references/authentication/workos.md:208 references/foundations/quickstart.md:103 references/patterns/common-patterns.md:704 references/patterns/common-patterns.md:21 references/patterns/common-patterns.md:705 references/server/resources.md:314 references/server/resources.md:58 references/server/resources.md:314 references/server/tools.md:310 references/server/tools.md:18 references/server/tools.md:311 references/widgets/advanced.md:204 references/widgets/basics.md:159 SKILL.md:114
📁 Filesystem access (40)
references/authentication/custom.md:215 references/authentication/custom.md:14 references/authentication/custom.md:22 references/authentication/custom.md:53 references/authentication/custom.md:84 references/authentication/custom.md:136 references/authentication/overview.md:184 references/authentication/overview.md:185 references/authentication/overview.md:28 references/authentication/supabase.md:178 references/authentication/workos.md:221 references/foundations/architecture.md:172 references/foundations/architecture.md:296 references/foundations/architecture.md:297 references/foundations/concepts.md:19 references/foundations/concepts.md:32 references/foundations/concepts.md:45 references/foundations/concepts.md:59 references/foundations/concepts.md:124 references/foundations/concepts.md:125 references/foundations/quickstart.md:241 references/foundations/quickstart.md:242 references/foundations/quickstart.md:243 references/foundations/quickstart.md:246 references/patterns/common-patterns.md:766 references/patterns/common-patterns.md:767 references/patterns/common-patterns.md:768 references/server/prompts.md:618 references/server/resources.md:502 references/server/response-helpers.md:340 references/server/response-helpers.md:626 references/server/response-helpers.md:627 references/server/tools.md:247 references/server/tools.md:390 references/server/tools.md:412 references/server/tools.md:413 references/widgets/advanced.md:810 references/widgets/advanced.md:811 references/widgets/interactivity.md:834 references/widgets/ui-guidelines.md:760
🔑 Env variables (47)
references/authentication/custom.md:163 references/authentication/custom.md:185 references/authentication/custom.md:163 references/authentication/custom.md:185 references/authentication/custom.md:185 references/authentication/supabase.md:72 references/authentication/supabase.md:125 references/authentication/supabase.md:130 references/authentication/supabase.md:72 references/authentication/supabase.md:125 references/authentication/supabase.md:130 references/authentication/workos.md:150 references/authentication/workos.md:150 references/authentication/workos.md:49 references/authentication/workos.md:150 references/authentication/workos.md:155 references/authentication/workos.md:163 references/authentication/workos.md:190 references/foundations/deployment.md:67 references/foundations/deployment.md:67 references/foundations/quickstart.md:103 references/foundations/quickstart.md:103 references/patterns/common-patterns.md:21 references/patterns/common-patterns.md:695 references/patterns/common-patterns.md:21 references/patterns/common-patterns.md:695 references/patterns/common-patterns.md:695 references/patterns/common-patterns.md:700 references/patterns/common-patterns.md:701 references/patterns/common-patterns.md:705 references/server/resources.md:456 references/server/resources.md:456 references/server/tools.md:18 references/server/tools.md:296 references/server/tools.md:321 references/server/tools.md:18 references/server/tools.md:296 references/server/tools.md:321 references/server/tools.md:331 references/server/tools.md:296 references/server/tools.md:304 references/server/tools.md:306 references/server/tools.md:311 references/server/tools.md:328 SKILL.md:226 SKILL.md:226 SKILL.md:226
⚡ Contains scripts (1)
Audited by: codex
Jul 6, 2026, 06:13 PM
Static analysis reported many severe patterns, but contextual review found them in Markdown documentation, examples, relative links, and placeholder configuration. No confirmed malicious intent, credential exfiltration, prompt-injection attempt, or runnable hidden behavior was found. The main residual risk is that users may copy example commands, network calls, or environment variable handling without adapting them safely.
20
Files scanned
8,688
Lines analyzed
5
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (230)
references/authentication/custom.md:142-156 references/authentication/custom.md:165-169 references/authentication/custom.md:169-170 references/authentication/custom.md:170-171 references/authentication/custom.md:171-172 references/authentication/custom.md:172-175 references/authentication/custom.md:175-178 references/authentication/custom.md:187-191 references/authentication/custom.md:191-192 references/authentication/custom.md:192-193 references/authentication/custom.md:193-194 references/authentication/custom.md:194-197 references/authentication/custom.md:197-206 references/authentication/overview.md:58-59 references/authentication/overview.md:59-61 references/authentication/overview.md:155-160 references/authentication/overview.md:160-166 references/authentication/supabase.md:137-140 references/authentication/supabase.md:140-147 references/authentication/supabase.md:147-153 references/authentication/workos.md:160-163 references/authentication/workos.md:163-170 references/authentication/workos.md:170-176 references/foundations/architecture.md:30-33 references/foundations/architecture.md:159-170 references/foundations/architecture.md:187-190 references/foundations/architecture.md:230-232 references/foundations/concepts.md:41-43 references/foundations/quickstart.md:116-121 references/foundations/quickstart.md:160-164 references/foundations/quickstart.md:164-168 references/foundations/quickstart.md:195-207 references/patterns/common-patterns.md:736-742 references/patterns/common-patterns.md:51-62 references/patterns/common-patterns.md:62-81 references/patterns/common-patterns.md:188-211 references/patterns/common-patterns.md:211-229 references/patterns/common-patterns.md:229-234 references/patterns/common-patterns.md:234-254 references/patterns/common-patterns.md:254-259 references/patterns/common-patterns.md:259-264 references/patterns/common-patterns.md:352-384 references/patterns/common-patterns.md:384-428 references/patterns/common-patterns.md:502-508 references/patterns/common-patterns.md:575-586 references/patterns/common-patterns.md:586-602 references/patterns/common-patterns.md:602-609 references/patterns/common-patterns.md:609-656 references/patterns/common-patterns.md:705-709 references/patterns/common-patterns.md:709-722 references/patterns/common-patterns.md:722-726 references/patterns/common-patterns.md:743-756 references/patterns/common-patterns.md:756-760 references/server/prompts.md:30-33 references/server/prompts.md:33-34 references/server/prompts.md:34-35 references/server/prompts.md:35-36 references/server/prompts.md:36-37 references/server/prompts.md:37-38 references/server/prompts.md:38-39 references/server/prompts.md:39-43 references/server/prompts.md:123-124 references/server/prompts.md:124-125 references/server/prompts.md:125-126 references/server/prompts.md:126-127 references/server/prompts.md:127-128 references/server/prompts.md:128-129 references/server/prompts.md:129-133 references/server/prompts.md:161-162 references/server/prompts.md:162-163 references/server/prompts.md:163-167 references/server/prompts.md:184-185 references/server/prompts.md:185-186 references/server/prompts.md:186-187 references/server/prompts.md:187-191 references/server/prompts.md:213-216 references/server/prompts.md:216-219 references/server/prompts.md:219-224 references/server/prompts.md:279-282 references/server/prompts.md:302-305 references/server/prompts.md:305-306 references/server/prompts.md:306-307 references/server/prompts.md:307-308 references/server/prompts.md:308-310 references/server/prompts.md:310-311 references/server/prompts.md:311-312 references/server/prompts.md:312-313 references/server/prompts.md:313-319 references/server/prompts.md:360-361 references/server/prompts.md:361-362 references/server/prompts.md:362-363 references/server/prompts.md:363-367 references/server/prompts.md:394-395 references/server/prompts.md:395-396 references/server/prompts.md:396-397 references/server/prompts.md:397-398 references/server/prompts.md:398-399 references/server/prompts.md:399-400 references/server/prompts.md:400-401 references/server/prompts.md:401-405 references/server/prompts.md:426-428 references/server/prompts.md:451-453 references/server/prompts.md:475-476 references/server/prompts.md:476-477 references/server/prompts.md:477-478 references/server/prompts.md:478-479 references/server/prompts.md:479-480 references/server/prompts.md:480-481 references/server/prompts.md:481-483 references/server/prompts.md:489-490 references/server/prompts.md:490-491 references/server/prompts.md:491-493 references/server/prompts.md:522-533 references/server/prompts.md:559-562 references/server/prompts.md:562-565 references/server/prompts.md:565-581 references/server/prompts.md:605-610 references/server/resources.md:131-133 references/server/resources.md:209-220 references/server/resources.md:315-318 references/server/resources.md:318-321 references/server/resources.md:486-494 references/server/response-helpers.md:47-64 references/server/response-helpers.md:64-65 references/server/response-helpers.md:65-66 references/server/response-helpers.md:66-70 references/server/response-helpers.md:155 references/server/response-helpers.md:159-167 references/server/response-helpers.md:171 references/server/response-helpers.md:173 references/server/response-helpers.md:179 references/server/response-helpers.md:183-186 references/server/response-helpers.md:218-230 references/server/response-helpers.md:255-261 references/server/response-helpers.md:261-274 references/server/response-helpers.md:274-285 references/server/response-helpers.md:324-328 references/server/response-helpers.md:358-360 references/server/response-helpers.md:360-372 references/server/response-helpers.md:372-381 references/server/response-helpers.md:402-403 references/server/response-helpers.md:403-407 references/server/response-helpers.md:430-432 references/server/response-helpers.md:476-492 references/server/response-helpers.md:504-515 references/server/response-helpers.md:515-533 references/server/response-helpers.md:533-552 references/server/response-helpers.md:552-558 references/server/response-helpers.md:586-587 references/server/response-helpers.md:587-589 references/server/response-helpers.md:593-595 references/server/tools.md:35-38 references/server/tools.md:110-113 references/server/tools.md:141-144 references/server/tools.md:144-149 references/server/tools.md:149-157 references/server/tools.md:181-191 references/server/tools.md:191-196 references/server/tools.md:235-239 references/server/tools.md:311-317 references/server/tools.md:348-368 references/widgets/advanced.md:204-233 references/widgets/basics.md:63-67 references/widgets/basics.md:664-670 references/widgets/interactivity.md:107-110 references/widgets/interactivity.md:180-183 references/widgets/interactivity.md:469-472 references/widgets/interactivity.md:548-554 references/widgets/interactivity.md:637-647 references/widgets/interactivity.md:684-694 references/widgets/state.md:164-176 references/widgets/ui-guidelines.md:74-80 references/widgets/ui-guidelines.md:120-127 references/widgets/ui-guidelines.md:142-148 references/widgets/ui-guidelines.md:193-205 references/widgets/ui-guidelines.md:238-261 references/widgets/ui-guidelines.md:321-357 references/widgets/ui-guidelines.md:376-391 references/widgets/ui-guidelines.md:434-435 references/widgets/ui-guidelines.md:435-445 references/widgets/ui-guidelines.md:456-458 references/widgets/ui-guidelines.md:512-518 references/widgets/ui-guidelines.md:703-722 references/widgets/ui-guidelines.md:722-753 SKILL.md:38 SKILL.md:40-51 SKILL.md:51-53 SKILL.md:53 SKILL.md:59-63 SKILL.md:63-89 SKILL.md:89-90 SKILL.md:90-123 SKILL.md:123 SKILL.md:132 SKILL.md:136 SKILL.md:140-144 SKILL.md:144 SKILL.md:163-186 SKILL.md:186-206 SKILL.md:206 SKILL.md:207-211 SKILL.md:211-212 SKILL.md:212-215 SKILL.md:215 SKILL.md:216-218 SKILL.md:218-219 SKILL.md:219 SKILL.md:220-222 SKILL.md:222-226 SKILL.md:226 SKILL.md:228-242 SKILL.md:242-243 SKILL.md:243 SKILL.md:247 SKILL.md:248-252 SKILL.md:252 SKILL.md:253 SKILL.md:255 SKILL.md:256-258 SKILL.md:258-282 SKILL.md:282-302 SKILL.md:302-322 SKILL.md:322-330 SKILL.md:330 SKILL.md:331 SKILL.md:332 SKILL.md:333 SKILL.md:334 SKILL.md:335 SKILL.md:336
🌐 Network access (50)
references/authentication/custom.md:141 references/authentication/custom.md:14 references/authentication/custom.md:21 references/authentication/custom.md:22 references/authentication/custom.md:23 references/authentication/custom.md:24 references/authentication/custom.md:27 references/authentication/custom.md:52 references/authentication/custom.md:53 references/authentication/custom.md:54 references/authentication/custom.md:55 references/authentication/custom.md:84 references/authentication/custom.md:89 references/authentication/custom.md:135 references/authentication/custom.md:136 references/authentication/custom.md:137 references/authentication/custom.md:138 references/authentication/custom.md:141 references/authentication/custom.md:165 references/authentication/custom.md:169 references/authentication/custom.md:170 references/authentication/custom.md:171 references/authentication/custom.md:172 references/authentication/custom.md:175 references/authentication/custom.md:187 references/authentication/custom.md:191 references/authentication/custom.md:192 references/authentication/custom.md:193 references/authentication/custom.md:194 references/authentication/custom.md:197 references/authentication/overview.md:153 references/authentication/overview.md:153 references/authentication/supabase.md:136 references/authentication/supabase.md:137 references/authentication/workos.md:159 references/authentication/workos.md:160 references/authentication/workos.md:208 references/foundations/quickstart.md:103 references/patterns/common-patterns.md:704 references/patterns/common-patterns.md:21 references/patterns/common-patterns.md:705 references/server/resources.md:314 references/server/resources.md:58 references/server/resources.md:314 references/server/tools.md:310 references/server/tools.md:18 references/server/tools.md:311 references/widgets/advanced.md:204 references/widgets/basics.md:159 SKILL.md:114
📁 Filesystem access (40)
references/authentication/custom.md:215 references/authentication/custom.md:14 references/authentication/custom.md:22 references/authentication/custom.md:53 references/authentication/custom.md:84 references/authentication/custom.md:136 references/authentication/overview.md:184 references/authentication/overview.md:185 references/authentication/overview.md:28 references/authentication/supabase.md:178 references/authentication/workos.md:221 references/foundations/architecture.md:172 references/foundations/architecture.md:296 references/foundations/architecture.md:297 references/foundations/concepts.md:19 references/foundations/concepts.md:32 references/foundations/concepts.md:45 references/foundations/concepts.md:59 references/foundations/concepts.md:124 references/foundations/concepts.md:125 references/foundations/quickstart.md:241 references/foundations/quickstart.md:242 references/foundations/quickstart.md:243 references/foundations/quickstart.md:246 references/patterns/common-patterns.md:766 references/patterns/common-patterns.md:767 references/patterns/common-patterns.md:768 references/server/prompts.md:618 references/server/resources.md:502 references/server/response-helpers.md:340 references/server/response-helpers.md:626 references/server/response-helpers.md:627 references/server/tools.md:247 references/server/tools.md:390 references/server/tools.md:412 references/server/tools.md:413 references/widgets/advanced.md:810 references/widgets/advanced.md:811 references/widgets/interactivity.md:834 references/widgets/ui-guidelines.md:760
🔑 Env variables (47)
references/authentication/custom.md:163 references/authentication/custom.md:185 references/authentication/custom.md:163 references/authentication/custom.md:185 references/authentication/custom.md:185 references/authentication/supabase.md:72 references/authentication/supabase.md:125 references/authentication/supabase.md:130 references/authentication/supabase.md:72 references/authentication/supabase.md:125 references/authentication/supabase.md:130 references/authentication/workos.md:150 references/authentication/workos.md:150 references/authentication/workos.md:49 references/authentication/workos.md:150 references/authentication/workos.md:155 references/authentication/workos.md:163 references/authentication/workos.md:190 references/foundations/deployment.md:67 references/foundations/deployment.md:67 references/foundations/quickstart.md:103 references/foundations/quickstart.md:103 references/patterns/common-patterns.md:21 references/patterns/common-patterns.md:695 references/patterns/common-patterns.md:21 references/patterns/common-patterns.md:695 references/patterns/common-patterns.md:695 references/patterns/common-patterns.md:700 references/patterns/common-patterns.md:701 references/patterns/common-patterns.md:705 references/server/resources.md:456 references/server/resources.md:456 references/server/tools.md:18 references/server/tools.md:296 references/server/tools.md:321 references/server/tools.md:18 references/server/tools.md:296 references/server/tools.md:321 references/server/tools.md:331 references/server/tools.md:296 references/server/tools.md:304 references/server/tools.md:306 references/server/tools.md:311 references/server/tools.md:328 SKILL.md:226 SKILL.md:226 SKILL.md:226
⚡ Contains scripts (1)
Audited by: codex
Jun 30, 2026, 08:11 AM
Static analysis reported many severe patterns, but contextual review found them in Markdown documentation, examples, relative links, and license text rather than executable skill code. No confirmed malicious intent, credential exfiltration, prompt-injection attempt, or runnable hidden behavior was found. The main residual risk is that users may copy example commands, network calls, environment variable handling, or development-only options without adapting them safely.
20
Files scanned
8,688
Lines analyzed
5
Review items
6
False positives ignored
Static false positives ignored (6)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static external command matches are Markdown examples
The numerous external command findings are caused by fenced Markdown examples and CLI guidance. They document commands such as scaffolding, running development servers, and deployment checks, but the skill package does not include executable scripts that run them automatically.
The reviewed locations are documentation code fences and prose. No executable script file or automatic command runner was present in the file inventory.
Low
references/authentication/custom.md:13-28references/authentication/workos.md:159-164references/server/tools.md:310-312
Network findings are example URLs and documented API calls
Hardcoded URLs and fetch examples appear in authentication and tool documentation. They show OAuth discovery, provider APIs, localhost callbacks, and example weather APIs, not hidden outbound requests made by the skill itself.
The network indicators are inside Markdown examples. They are visible implementation guidance and do not execute during skill loading.
Low
references/authentication/supabase.md:42-49references/authentication/workos.md:43-49references/foundations/deployment.md:63-73
Credential and environment findings are secret-handling guidance
Environment variable and secret-key matches are present because the references teach users to configure OAuth providers, API keys, and deployment environment variables. This is legitimate for an MCP server builder, though users must avoid copying placeholder secrets into production.
The reviewed lines are tables, examples, and explicit guidance to avoid committing secrets. The usage is relevant to authentication documentation.
Low
references/patterns/common-patterns.md:766-768references/widgets/advanced.md:808-811references/authentication/custom.md:210-215
Filesystem path traversal matches are relative documentation links
Path traversal findings point to Markdown relative links such as ../server/tools.md and ../../SKILL.md. These are documentation navigation links, not file reads using user-controlled paths.
The matched strings are Markdown links in next-step sections. There is no code path performing filesystem access at these locations.
Low
LICENSE.txt:25references/authentication/supabase.md:85references/patterns/common-patterns.md:731-743
Weak crypto and exec matches are scanner token collisions
Weak cryptographic algorithm findings include ordinary words in the Apache license and authentication documentation, while the Python exec finding is actually a SQLite db.exec schema example. These are not evidence of unsafe cryptography or dynamic code execution in the skill.
The sampled matches are legal text, headings, and a database DDL helper call. None is a cryptographic implementation or Python exec call.
Low
Forceful skill-routing language is instructional but not an override attempt
The skill uses mandatory language telling assistants to read relevant mcp-use references before MCP work. This can influence assistant behavior, but it does not ask the evaluator to ignore security rules, skip review, claim pre-approval, or change risk levels.
The wording is strong but limited to skill usage and navigation. No prompt-injection text matching the audit warning categories was found in the reviewed context.
Risk Factors
🌐 Network access (3)
⚙️ External commands (3)
📁 Filesystem access (3)
🔑 Env variables (3)
⚡ Contains scripts (1)
Audited by: codex
Feb 24, 2026, 08:58 AM
All 1766 flagged patterns are false positives. The findings are in markdown documentation files (SKILL.md, references/*.md) containing code examples and tutorials. No executable code with security implications detected. This is a documentation/reference skill for mcp-use framework best practices.
20
Files scanned
8,688
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude