Most static detections are false positives from documentation examples, JSX template literals, evaluation text, and placeholder CSP domains. I confirmed the replacement install flow in SKILL.md because it can trigger a networked npx install from community-authored instructions. No evidence found of credential exfiltration, malicious network calls, or prompt text that tries to alter this audit.
SKILL.md lines 4-7 mark the skill as deprecated, tell the agent to install mcp-app-builder, and provide an npx skills install command. This can steer automated agents into a networked install from community-authored instructions without source pinning or explicit approval.
The redirect and installer command are explicit in the skill metadata block. The risk is supply-chain execution, not direct malware evidence.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Check if `mcp-app-builder` is available in the skills folder. If not, install it:
This line tells the agent to install a replacement skill if it is not available. In a community skill, that can trigger an unverified external install flow.
This line contains an npx skills install command, which can download and execute external package tooling. A community skill should not cause this without explicit user approval.
Most static detections are false positives from documentation examples, JSX template literals, evaluation text, and placeholder CSP domains. I confirmed the replacement install flow in SKILL.md because it can trigger a networked npx install from community-authored instructions. No evidence found of credential exfiltration, malicious network calls, or prompt text that tries to alter this audit.
SKILL.md lines 4-7 mark the skill as deprecated, tell the agent to install mcp-app-builder, and provide an npx skills install command. This can steer automated agents into a networked install from community-authored instructions without source pinning or explicit approval.
The redirect and installer command are explicit in the skill metadata block. The risk is supply-chain execution, not direct malware evidence.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Check if `mcp-app-builder` is available in the skills folder. If not, install it:
This line tells the agent to install a replacement skill if it is not available. In a community skill, that can trigger an unverified external install flow.
This line contains an npx skills install command, which can download and execute external package tooling. A community skill should not cause this without explicit user approval.
Most static findings are false positives from markdown examples, API reference tables, and evaluation prompts. One medium-risk finding is confirmed because the deprecated skill description includes an npx installer command for a replacement skill. No prompt injection or data exfiltration intent was found.
18
Files scanned
2,247
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill frontmatter includes an npx skills install command that can fetch and install another skill from a repository. It may be legitimate migration guidance, but it is still an external package execution path that should require explicit user review.