Rapid Prototyper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:13 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent rapid MVP helper, but it encourages unpinned remote tooling, production deployment, and always-on feedback collection without enough safeguards.

Install only if you are comfortable with a speed-first skill that may run package scaffolding, install dependencies, configure external services, push schema changes, collect feedback data, and deploy publicly. Pin package versions, review generated code and lockfiles, avoid global CLI installs, confirm production targets before deploying, and add privacy and server-side validation safeguards before using generated apps with real users or sensitive data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44
• Finding: Unpinned Third-Party Packages Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md:44-49`, `SKILL.md:58`; `references/stack-setup.md:4-22`, `references/stack-setup.md:136-140` **Vulnerability Type**: Supply-chain exposure through mutable and unpinned dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:44-49`: ```bash npx create-next-app@latest my-app --typescript --tailwind --eslint --app cd my-app npx shadcn@latest init ``` `SKILL.md:58`: ```bash npx vercel --prod ``` `references/stack-setup.md:4-22`: ```bash # 1. Create Next.js app npx create-next-app@latest my-app --typescript --tailwind --eslint --app cd my-app # 2. shadcn/ui npx shadcn@latest init npx shadcn@latest add button input label card dialog form toast # 3. Prisma + Supabase npm install prisma @prisma/client @supabase/supabase-js npx prisma init # 4. Clerk auth npm install @clerk/nextjs # 5. Zustand + forms npm install zustand react-hook-form @hookform/resolvers zod # 6. Optional: Framer Motion npm install framer-motion ``` `references/stack-setup.md:136-140`: ```bash ## Deploy to Vercel ```bash npm install -g vercel vercel # preview deploy vercel --prod # production deploy ``` ### Technical Analysis Commands such as `npx create-next-app@latest` and `npx shadcn@latest` resolve mutable package releases at execution time and immediately run downloaded code. The remaining `npm install` commands also omit exact versions. Consequently, the effective code executed or installed by the Skill can change after the Skill itself has been reviewed. npm packages may execute lifecycle scripts during installation. If a referenced package, one of its transitive dependencies, or its publishing account is compromised, a malicious release can execute code with the permissions of the user or agent running these commands. Installing Vercel globally also modifies the user's global tool environment rather than confining the ...[truncated 1573 chars]
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with exact, reviewed package versions. 2. Pin all direct dependency versions and commit the generated lockfile. 3. Use `npm ci` for repeatable installation after the initial reviewed lockfile has been created. 4. Avoid global CLI installation. Add Vercel as a version-pinned development dependency and invoke the local binary. 5. Review transitive dependency changes before updating the lockfile. 6. Verify package provenance, registry source, integrity metadata, and publisher identity. 7. Run scaffolding and installation in an isolated, least-privileged environment without production credentials. 8. Consider initially disabling lifecycle scripts with `npm install --ignore-scripts`, then explicitly allowing only reviewed scripts where operationally feasible. 9. Add automated dependency scanning and lockfile integrity checks to the generated project's CI workflow.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/patterns.md:18
• Finding: API Template Permits Unsafe Mass Assignment of Client-Controlled Fields## Vulnerability Details **File Location**: `references/patterns.md:18-25` **Vulnerability Type**: Missing server-side input validation and unsafe mass assignment **Risk Level**: Medium ### Vulnerable Code ```ts export async function POST(req: Request) { const { userId } = auth() if (!userId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) const body = await req.json() const item = await prisma.item.create({ data: { ...body, userId } }) return NextResponse.json(item, { status: 201 }) } ``` ### Technical Analysis The route parses an arbitrary JSON body and spreads every supplied property directly into the Prisma `create` operation. Authentication is present, and the trailing `userId` assignment prevents the caller from overriding that particular field. However, no server-side schema restricts the remaining properties. The Zod schema shown elsewhere in the file is applied only through the client-side React form. Client-side validation is not a security boundary because an attacker can call the API directly with a custom HTTP client. Prisma can reject properties that do not exist in the model, but it will accept client-supplied values for writable fields that do exist. As the model evolves, fields such as status, role, approval state, pricing, visibility, moderation state, or other internal attributes could unintentionally become assignable. The unrestricted body also permits malformed values and oversized or unexpected structures to reach the ORM, potentially causing server errors and unnecessary resource consumption. ### Attack Path 1. An attacker obtains a valid authenticated session, satisfying the Clerk authentication check. 2. The attacker bypasses the user interface and sends a direct `POST` request to `/api/items`. 3. The request body includes legitimate fields plus a sensitive writable model field omitted from the UI, such as an approval or visibility field. 4. The route pa ...[truncated 993 chars]
• Remediation: ## Remediation Suggestions 1. Define a strict server-side Zod schema for every API request. 2. Reject unknown properties with `.strict()` rather than silently accepting them. 3. Construct the Prisma `data` object from an explicit allowlist instead of spreading the request body. 4. Apply authorization checks separately from syntactic validation for every sensitive operation. 5. Set ownership, workflow state, approval fields, and other trusted attributes exclusively on the server. 6. Set a request body size limit and return controlled validation errors. 7. Add tests that submit unexpected and privileged fields directly to the API. A hardened implementation would resemble: ```ts const createItemSchema = z.object({ title: z.string().min(1).max(100), description: z.string().max(2000).optional(), }).strict() export async function POST(req: Request) { const { userId } = auth() if (!userId) { return NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) } const input = createItemSchema.parse(await req.json()) const item = await prisma.item.create({ data: { title: input.title, description: input.description, userId, }, }) return NextResponse.json(item, { status: 201 }) } ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The description says the skill triggers when a user asks to "build," "prototype," "create a quick app," or "wants a working thing fast." Several of these are broad everyday phrases that can overlap with many unrelated coding requests, and the file does not provide a constrained invocation list or negative examples beyond excluding small fixes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The skill instructs users to execute `npx create-next-app@latest`, which fetches and runs remote package code at the latest available version. This creates a supply-chain risk because behavior can change over time or a compromised upstream package could execute unexpected code during scaffolding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The `npx shadcn@latest init` command pulls and executes the latest remote code without version pinning. In a speed-focused skill, users are more likely to run it blindly, increasing exposure to supply-chain compromise or breaking changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill recommends analytics, feedback collection, and action logging by default without privacy guardrails, consent guidance, retention limits, or warnings against collecting secrets and sensitive personal data. In a rapid-prototyping context, this can normalize unsafe telemetry practices that expose user data or create compliance issues.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: `npx vercel --prod` executes an unpinned CLI fetched at runtime, which introduces the same supply-chain and unpredictability risks as other unpinned `npx` commands. Because it targets production deployment, misuse or compromised tooling could directly affect a live environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Phase 5 — Deploy
```bash
npx vercel --prod
# or: push to GitHub → auto-deploy on Vercel
```

## Critical Rules

• Confidence: 85% confidence
• Finding: Recommending GitHub-triggered auto-deploy for a speed-first MVP can cause unreviewed or insufficiently tested changes to reach a live environment automatically. In combination with the skill's bias toward rapid shipping and skipped edge cases, this increases the chance of exposing insecure code, secrets, or broken access controls in production.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Critical Rules

- **Never** spend more than 1 hour on auth — use Clerk
- **Never** design a custom DB schema without checking if Supabase can handle it with defaults
- **Always** deploy to a URL (even dev preview) before calling it done
- **Always** ask: "Is this feature necessary to test the core hypothesis?"

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The pattern explicitly says to 'always include' a feedback widget, which normalizes shipping telemetry-like data collection in every MVP regardless of user need. In a rapid-prototyping skill, this is risky because developers may copy it broadly without adding consent, disclosure, retention limits, or backend protections, expanding unnecessary collection of user interaction context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example sends free-form feedback together with window.location.href to the server without any user-facing notice about the exact data transmitted. URLs can contain sensitive path segments, query parameters, invite tokens, reset links, or internal identifiers, and free-text feedback can include personal or confidential information, creating avoidable privacy leakage.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The snippet sets `<html lang="en">`, which forces a specific language/locale in the example. The file does not indicate that English is optional, configurable, or required for a region-specific use case.

Missing User Warnings

Low

• Confidence: 75% confidence
• Finding: This markdown file instructs users to deploy to Vercel and add environment variables, which can affect production systems and sensitive configuration. The section does not include any explicit warning to verify secrets, production targets, or the impact of running a production deploy.

Static analysis

No suspicious patterns detected.