Security audit

openui-forge

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently helps build OpenUI generative UI projects, with expected package installation, project scanning, and LLM-provider data flow disclosed in its instructions and templates.

Install this only if you intend to add OpenUI code to a project. Review package versions before running npx or npm install, keep provider API keys in environment or secret management, and tell end users when chat content is sent to an external model provider.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (50)

Ae1

High

Category: analysis-evasion
Content: Template: templates/api-route-anthropic.ts.template
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: Template: templates/api-route-langchain.ts.template
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: Run `scripts/validate.sh` (or `.ps1`) for automated checks.
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Content: get("messages", []) api_messages = [{"role": "system", "content": system_prompt}] for msg in messages: api_messages.append({ "role": msg.get("role", "user"), "content": msg.get("content", ""), }) async def generate(): completion_id = f"chatcmpl-{uuid.uuid4().hex[:12]}" stream = await client.chat.completions.create( model=os.getenv("OPENAI_MODEL", "gpt-5.5"), messages=api_messages, stream=True, ) async for chunk in stream: delta = chunk.choices[0].delta if chunk.choices else None finish_reason = chunk.choices[0].finish_reason if chunk.choices else None if delta and delta.content: line = json.dumps({ "id": completion_id, "object": "chat.completion.chunk", "choices": [{ "index": 0, "delta": {"content": delta.
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

Category: Privilege Escalation
Content: # ------------------------------------------------------------------------- # gem "rails", "~> 8.1" # # Net::HTTP is in the standard library — no extra HTTP-client gem required. # # Optional: load OPENAI_API_KEY etc. from a .env file in development. # gem "dotenv-rails", groups: [:development, :test] # # Then: bundle install
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: # ------------------------------------------------------------------------- # gem "rails", "~> 8.1" # # Net::HTTP is in the standard library — no extra HTTP-client gem required. # # Optional: load OPENAI_API_KEY etc. from a .env file in development. # gem "dotenv-rails", groups: [:development, :test] # # Then: bundle install
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: # ------------------------------------------------------------------------- # gem "rails", "~> 8.1" # # Net::HTTP is in the standard library — no extra HTTP-client gem required. # # Optional: load OPENAI_API_KEY etc. from a .env file in development. # gem "dotenv-rails", groups: [:development, :test] # # Then: bundle install
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation triggers are broad phrases like `streaming ui`, `copilot ui`, and `chat ui with components`, which can match normal discussion rather than a deliberate request to invoke this skill. In agent systems, overly broad triggers can cause unintended activation and tool behavior in unrelated contexts, increasing the chance of unreviewed code changes or external calls.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of `npx @openuidev/cli` without pinning a specific version, which means executions can pull whatever package version is latest at runtime. In an agent context, this creates a supply-chain risk: a compromised maintainer account, malicious release, or breaking update could cause arbitrary code execution on the host when the command is run.

External Transmission

Medium

Category: Data Exfiltration
Content: |----------|-------------------|------------------| | Gemini (Google) | `https://generativelanguage.googleapis.com/v1beta/openai/` | `gemini-2.5-flash` | | OpenRouter | `https://openrouter.ai/api/v1` | `openai/gpt-4o` | | xAI (Grok) | `https://api.x.ai/v1` | `grok-4` | | DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` |
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: | OpenRouter | `https://openrouter.ai/api/v1` | `openai/gpt-4o` | | xAI (Grok) | `https://api.x.ai/v1` | `grok-4` | | DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` |
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: | xAI (Grok) | `https://api.x.ai/v1` | `grok-4` | | DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` | | Ollama (local) | `http://localhost:11434/v1/` | `llama3.2` (any placeholder api key) |
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: | DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` | | Ollama (local) | `http://localhost:11434/v1/` | `llama3.2` (any placeholder api key) | | LM Studio (local) | `http://localhost:1234/v1` | `mistral-7b-instruct-v0.3` (any placeholder api key) |
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` | | Ollama (local) | `http://localhost:11434/v1/` | `llama3.2` (any placeholder api key) | | LM Studio (local) | `http://localhost:1234/v1` | `mistral-7b-instruct-v0.3` (any placeholder api key) |
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: templates/handler-csharp.cs.template:103

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/backend-patterns.md:294

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/component-patterns.md:1187

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:317