Security audit

openui-forge

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent OpenUI app-building purpose, but needs Review because its generated chat servers can expose your paid AI provider key to unauthenticated use unless you add access controls.

Before installing or using this skill for anything beyond local development, pin the CLI and package versions, review the generated backend before deployment, add real authentication and authorization to /api/chat, enforce rate limits, request-size limits, message-count/content limits, and provider spending caps, and make sure users understand that chat content and the generated system prompt are sent to the configured model provider.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: templates/api-route-openai.ts.template:21
Finding: Unauthenticated Chat Endpoints Permit Abuse of Provider-Funded Inference
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: templates/handler-go.go.template:88
Finding: Unbounded Request Bodies and Message Arrays Enable Resource and Cost Exhaustion
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:102
Finding: Unpinned NPM and NPX Commands Execute Remotely Resolved Package Code
Content: View full analysis
npx @openuidev/cli@latest create --name ${PROJECT_NAME} | Done. Run /openui:integrate next. | +-- YES --> What framework? | +-- Next.js | 1. npm install @openuidev/react-ui @openuidev/react-headless @openuidev/react-lang lucide-react zod | 2. Add CSS import to root layout (full stylesheet): | import "@openuidev/react-ui/index.css"; | (components.css and defaults.css also exist if you want only part of it) | 3. Create component library file (or use built-in openuiChatLibrary from @openuidev/react-ui/genui-lib) | 4. Run /openui:integrate to wire the backend | +-- Vite + React | Same deps as Next.js. Create a proxy to backend in vite.config.ts. | +-- Non-JS backend (Python / Go / Rust / Ruby) 1. Create React frontend (Next.js or Vite) with OpenUI deps 2. npx @openuidev/cli generate ./src/lib/library.ts --out system-prompt.txt ``` Other unpinned installation instructions include: ```bash npm install openai npm install @anthropic-ai/sdk npm install ai @ai-sdk/openai npm install @langchain/openai @langchain/core pip install fastapi uvicorn openai ``` The prompt-generation workflow also executes an unpinned CLI: ```bash npx @openuidev/cli generate ./src/lib/library.ts --out src/generated/system-prompt.txt npx @openuidev/cli generate ./src/lib/library.ts --json-schema --out src/generated/schema.json ``` ### Technical Analysis The Skill instructs the Agent to run `npx @openuidev/cli@latest`, which explicitly resolves and executes the package version associated with the mutable `latest` distribution tag. Othe ...[truncated 1901 chars]
Remediation: View remediation
`. 4. Record and verify package integrity hashes through the lockfile. 5. Review package provenance, publisher identity, release signatures, and ownership changes before upgrading. 6. Disable lifecycle scripts where feasible during installation, then explicitly run only required reviewed build steps. 7. Perform package execution in a sandbox or restricted container with minimal filesystem, credential, and network access. 8. Pin Python dependencies to reviewed versions with hashes, such as a hash-locked requirements file. 9. Establish a controlled dependency-update process that reruns security review before changing pinned versions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (50)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
2. Read `references/component-patterns.md` for examples matching the use case

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
2. Read `references/component-patterns.md` for examples matching the use case

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.
md
Template: templates/api-route-anthropic.ts.template

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
Template: templates/api-route-langchain.ts.template

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.
md
Run `scripts/validate.sh` (or `.ps1`) for automated checks.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.
md
**Read `references/openui-lang-spec.md` for the full specification.**

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/backend-patterns.md (reported line 88)May include surrounding context.
md
get("messages", []) api_messages = [{"role": "system", "content": system_prompt}] for msg in messages: api_messages.append({ "role": msg.get("role", "user"), "content": msg.get("content", ""), }) async def generate(): completion_id = f"chatcmpl-{uuid.uuid4().hex[:12]}" stream = await client.chat.completions.create( model=os.getenv("OPENAI_MODEL", "gpt-5.5"), messages=api_messages, stream=True, ) async for chunk in stream: delta = chunk.choices[0].delta if chunk.choices else None finish_reason = chunk.choices[0].finish_reason if chunk.choices else None if delta and delta.content: line = json.dumps({ "id": completion_id, "object": "chat.completion.chunk", "choices": [{ "index": 0, "delta": {"content": delta.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/backend-patterns.md (reported line 805)May include surrounding context.
md
# ------------------------------------------------------------------------- # gem "rails", "~> 8.1" # # Net::HTTP is in the standard library — no extra HTTP-client gem required. # # Optional: load OPENAI_API_KEY etc. from a .env file in development. # gem "dotenv-rails", groups: [:development, :test] # # Then: bundle install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/handler-csharp.cs.template (reported line 34)May include surrounding context.
text
# ------------------------------------------------------------------------- # gem "rails", "~> 8.1" # # Net::HTTP is in the standard library — no extra HTTP-client gem required. # # Optional: load OPENAI_API_KEY etc. from a .env file in development. # gem "dotenv-rails", groups: [:development, :test] # # Then: bundle install

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/handler-ruby.rb.template (reported line 17)May include surrounding context.
text
# ------------------------------------------------------------------------- # gem "rails", "~> 8.1" # # Net::HTTP is in the standard library — no extra HTTP-client gem required. # # Optional: load OPENAI_API_KEY etc. from a .env file in development. # gem "dotenv-rails", groups: [:development, :test] # # Then: bundle install

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs use of npx @openuidev/cli without a pinned version, which causes execution of whatever package version is latest at runtime. If the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled code during scaffolding or prompt generation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command uses unpinned npx @openuidev/cli, so the exact code executed depends on the current registry state rather than a reviewed artifact. In an agent skill context, that is risky because the instruction encourages direct execution of remote package code as part of the workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill tells users to run npx @openuidev/cli generate ... without pinning the package version, enabling arbitrary upstream changes to alter or compromise local execution. Because npx fetches and runs code, this is effectively a remote code execution trust boundary issue, even if it is common developer practice.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
md
|----------|-------------------|------------------| | Gemini (Google) | `https://generativelanguage.googleapis.com/v1beta/openai/` | `gemini-2.5-flash` | | OpenRouter | `https://openrouter.ai/api/v1` | `openai/gpt-4o` | | xAI (Grok) | `https://api.x.ai/v1` | `grok-4` | | DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
md
| OpenRouter | `https://openrouter.ai/api/v1` | `openai/gpt-4o` | | xAI (Grok) | `https://api.x.ai/v1` | `grok-4` | | DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.
md
| xAI (Grok) | `https://api.x.ai/v1` | `grok-4` | | DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` | | Ollama (local) | `http://localhost:11434/v1/` | `llama3.2` (any placeholder api key) |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.
md
| DeepSeek | `https://api.deepseek.com` | `deepseek-chat` | | Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` | | Ollama (local) | `http://localhost:11434/v1/` | `llama3.2` (any placeholder api key) | | LM Studio (local) | `http://localhost:1234/v1` | `mistral-7b-instruct-v0.3` (any placeholder api key) |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.
md
| Groq | `https://api.groq.com/openai/v1` | `llama-3.3-70b-versatile` | | Mistral | `https://api.mistral.ai/v1` | `mistral-large-latest` | | Together | `https://api.together.ai/v1` | `meta-llama/Llama-3.3-70B-Instruct-Turbo` | | Fireworks | `https://api.fireworks.ai/inference/v1` | `accounts/fireworks/models/llama-v3p3-70b-instruct` | | Ollama (local) | `http://localhost:11434/v1/` | `llama3.2` (any placeholder api key) | | LM Studio (local) | `http://localhost:1234/v1` | `mistral-7b-instruct-v0.3` (any placeholder api key) |

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This example again recommends executing an unpinned package via npx, making builds non-reproducible and exposing users to supply-chain compromise. In a skill that automates scaffolding and code generation, this increases the chance of silently propagating malicious outputs into a project.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The unpinned npx invocation for JSON schema generation has the same supply-chain and remote execution risk as the other occurrences. A malicious or compromised release could run arbitrary code on the developer machine and alter generated artifacts or exfiltrate local data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file includes a Go backend example that makes direct HTTP calls to the OpenAI API and forwards chat contents, but the surrounding documentation does not explicitly warn readers that user-provided message data will be sent to an external provider. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors affecting user data or privacy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document explains that system-prompt.txt is generated and injected server-side, but it does not clearly warn that this prompt content is included in requests to external LLM APIs alongside user messages. That omission matters because the prompt may contain proprietary component definitions or internal rules, which is a privacy and data-handling concern under the markdown-file criteria for SQP-2.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 65% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/validate.sh (reported line 185)May include surrounding context.
sh
# ── Check 10: CORS headers ────────────────────────────────────────────────── # Only relevant when backend and frontend appear to be on different ports/origins cors_hit=$(sgrep -rlE "(Access-Control-Allow-Origin|cors|CORS)" --include="*.ts" --include="*.js" --include="*.py" --include="*.go" . \ | grep -v node_modules | head -n1) # Check if there's a separate backend config suggesting cross-origin setup

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This route forwards the full messages array, along with the system prompt, to an external OpenAI service. While the network call is evident in code, there is no confirmation prompt, user-facing log, or inline disclosure indicating that user-provided content will be transmitted off-system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The route sends modelMessages, derived from the request body, to OpenAI via streamText. While this network call is central to the route's function, the file contains no user-facing warning, confirmation, or disclosure that submitted content will be sent to a third-party model provider.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: templates/handler-csharp.cs.template:103

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/backend-patterns.md:294

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/component-patterns.md:1187

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:317