Lovable MCP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned with Lovable, but it grants broad project, workspace, deployment, database, and token authority with weak scoping and incomplete safety controls.

Review this skill before installing. Use it only if you intentionally want an agent to operate your Lovable account, and avoid broad workspace/write/offline access unless needed. Confirm deployments, database changes, connector removal, project deletion, and governance updates explicitly, and store any refresh token in a secure credential store or a tightly permissioned file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:80

Finding

Long-Lived OAuth Tokens Are Stored Without Enforced Filesystem Protection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 80–85; related scope and security guidance at lines 138 and 328–332
Vulnerability Type: Insecure storage of sensitive OAuth credentials
Risk Level: Medium

Vulnerable Snippet

markdown

The script will:
1. Generate a cryptographically random PKCE code_verifier + code_challenge
2. Print an authorization URL for you to open in your browser
3. Wait for you to paste back the redirect URL containing the `?code=` parameter
4. Exchange the code for access + refresh tokens
5. Save the tokens to `config/lovable-tokens.json`

The requested authorization scope is documented separately:

markdown

| `scope` | `offline projects:read projects:write projects:create workspaces:read workspaces:write` |

The only documented local protection is repository exclusion:

markdown

- **Never commit tokens or credentials to git.** The `config/lovable-tokens.json` file should be in your `.gitignore`.
- The access token is a JWT that expires after 8 hours. The refresh token is a long-lived secret.

Technical Analysis

The skill directs users to persist an access token and a long-lived refresh token in a JSON file. It does not require restrictive filesystem permissions, encryption at rest, an operating-system credential store, atomic file creation, or validation that the file is excluded from version control.

Adding a path to .gitignore only reduces one accidental publication scenario. It does not protect the token from other local users, processes running under the same account, backups, workspace synchronization, overly broad file permissions, or manual repository inclusion. The artifact contains no .gitignore or token-management scripts, so the claimed storage implementation and its permissions cannot be verified.

The offline scope enables refresh-token use beyond the access token’s eight-hour lifetime. The requested write scopes also ...[truncated 2106 chars]

Remediation

View remediation

Remediation Suggestions

1. Store refresh tokens in an operating-system keychain, credential manager, or dedicated secret-management service rather than a plaintext JSON file.
2. If file-based storage is unavoidable:
   • Create the configuration directory with mode 0700.
   • Create the token file with mode 0600.
   • Use atomic creation with exclusive-open semantics to avoid unsafe intermediate files.
   • Reject operation if ownership or permissions are broader than expected.
   • Avoid logging token values, authorization codes, or complete redirect URLs.
3. Include and verify an effective .gitignore entry for config/lovable-tokens.json; also add secret-scanning controls and a pre-commit check.
4. Request only the minimum OAuth scopes needed for the current operation. Avoid offline, project-write, workspace-write, database, governance, or deployment privileges unless explicitly required.
5. Require explicit user confirmation before destructive or externally visible operations such as deployment, database changes, connector removal, or governance modification.
6. Document token revocation procedures and provide a supported revocation mechanism rather than relying only on contacting support.
7. Include the referenced scripts in the audited package so their endpoint validation, PKCE state verification, file handling, logging behavior, and refresh-token implementation can be reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill's trigger conditions are so broad that they can activate for generic requests like 'make me an app' or 'build a dashboard,' causing an agent to invoke a high-privilege integration without clear user intent specific to Lovable. Because this skill can create, modify, deploy projects, query databases, and change governance settings, over-triggering increases the risk of unintended external actions and data exposure.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

2. Fetch OAuth metadata from `https://lovable.dev/oauth/.well-known/oauth-authorization-server`
3. Redirect user to the authorization endpoint with PKCE
4. Exchange the authorization code for tokens at the token endpoint
5. Use the access token as `Authorization: Bearer` in all subsequent calls

## Prerequisites

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

2. Fetch OAuth metadata from `https://lovable.dev/oauth/.well-known/oauth-authorization-server`
3. Redirect user to the authorization endpoint with PKCE
4. Exchange the authorization code for tokens at the token endpoint
5. Use the access token as `Authorization: Bearer` in all subsequent calls

## Prerequisites

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

2. Fetch OAuth metadata from `https://lovable.dev/oauth/.well-known/oauth-authorization-server`
3. Redirect user to the authorization endpoint with PKCE
4. Exchange the authorization code for tokens at the token endpoint
5. Use the access token as `Authorization: Bearer` in all subsequent calls

## Prerequisites

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

md

2. Fetch OAuth metadata from `https://lovable.dev/oauth/.well-known/oauth-authorization-server`
3. Redirect user to the authorization endpoint with PKCE
4. Exchange the authorization code for tokens at the token endpoint
5. Use the access token as `Authorization: Bearer` in all subsequent calls

## Prerequisites

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation highlights powerful capabilities such as project CRUD, deployment, governance changes, and analytics access, but it does not prominently warn that these actions can change production state, access workspace data, or affect other users. In a skill context, missing warnings and approval requirements can lead agents or operators to treat destructive or sensitive operations as routine.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

TOKEN=$(bash scripts/lovable-get-token.sh)

# Test: list your profile and workspaces
curl -s -X POST https://mcp.lovable.dev/ \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer $TOKEN" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

When the access token expires (after 8 hours), use the refresh token:

bash

curl -s -X POST https://lovable.dev/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=<your-refresh-token>" \

Static analysis

No suspicious patterns detected.