Versioned security assessment

Report ID: SA-DA1AE9BA

6/30/2026, 8:11:41 AM

mcp-apps-builder security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
mcp-apps-builder
Version
v2
Maintainer
mcp-use
Source
github.com/mcp-use/mcp_use/tree/main/skills/mcp-apps-builder/
Coverage
20 Files scanned · 8,688 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported many severe patterns, but contextual review found them in Markdown documentation, examples, relative links, and license text rather than executable skill code. No confirmed malicious intent, credential exfiltration, prompt-injection attempt, or runnable hidden behavior was found. The main residual risk is that users may copy example commands, network calls, environment variable handling, or development-only options without adapting them safely.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

20 Files scanned · 8,688 Lines analyzed

0 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 3 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (6)
Low
SKILL.md:59-63references/foundations/deployment.md:9-13references/foundations/deployment.md:21-29
Static external command matches are Markdown examples
The numerous external command findings are caused by fenced Markdown examples and CLI guidance. They document commands such as scaffolding, running development servers, and deployment checks, but the skill package does not include executable scripts that run them automatically.
The reviewed locations are documentation code fences and prose. No executable script file or automatic command runner was present in the file inventory.
Low
references/authentication/custom.md:13-28references/authentication/workos.md:159-164references/server/tools.md:310-312
Network findings are example URLs and documented API calls
Hardcoded URLs and fetch examples appear in authentication and tool documentation. They show OAuth discovery, provider APIs, localhost callbacks, and example weather APIs, not hidden outbound requests made by the skill itself.
The network indicators are inside Markdown examples. They are visible implementation guidance and do not execute during skill loading.
Low
references/authentication/supabase.md:42-49references/authentication/workos.md:43-49references/foundations/deployment.md:63-73
Credential and environment findings are secret-handling guidance
Environment variable and secret-key matches are present because the references teach users to configure OAuth providers, API keys, and deployment environment variables. This is legitimate for an MCP server builder, though users must avoid copying placeholder secrets into production.
The reviewed lines are tables, examples, and explicit guidance to avoid committing secrets. The usage is relevant to authentication documentation.
Low
references/patterns/common-patterns.md:766-768references/widgets/advanced.md:808-811references/authentication/custom.md:210-215
Filesystem path traversal matches are relative documentation links
Path traversal findings point to Markdown relative links such as ../server/tools.md and ../../SKILL.md. These are documentation navigation links, not file reads using user-controlled paths.
The matched strings are Markdown links in next-step sections. There is no code path performing filesystem access at these locations.
Low
LICENSE.txt:25references/authentication/supabase.md:85references/patterns/common-patterns.md:731-743
Weak crypto and exec matches are scanner token collisions
Weak cryptographic algorithm findings include ordinary words in the Apache license and authentication documentation, while the Python exec finding is actually a SQLite db.exec schema example. These are not evidence of unsafe cryptography or dynamic code execution in the skill.
The sampled matches are legal text, headings, and a database DDL helper call. None is a cryptographic implementation or Python exec call.
Low
SKILL.md:3-15SKILL.md:18-26
Forceful skill-routing language is instructional but not an override attempt
The skill uses mandatory language telling assistants to read relevant mcp-use references before MCP work. This can influence assistant behavior, but it does not ask the evaluator to ignore security rules, skip review, claim pre-approval, or change risk levels.
The wording is strong but limited to skill usage and navigation. No prompt-injection text matching the audit warning categories was found in the reviewed context.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable