AI Labs Builder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:15 PM UTC
• Version: 1.0.0

Overview

This is a real project generator, but its broad triggers, unpinned remote package execution, and insecure generated endpoints make it something users should review before installing.

Install only if you are comfortable reviewing and running the generated shell scripts. Run scaffolding in a disposable or sandboxed directory, review generated code before deployment, pin package versions, add authentication and rate limits before exposing the AI chat or webhook endpoints, and do not rely on the generated examples as production-ready security controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/create-ai-app.sh:62

Finding

Unpinned Remote Package Download and Execution

Content

View full analysis

/dev/null || true log_info "Installazione dipendenze AI..." npm install ai openai @anthropic-ai/sdk framer-motion lucide-react npm install @upstash/redis @upstash/ratelimit log_info "Setup shadcn/ui..." npx shadcn@latest init -y -d npx shadcn@latest add button card input textarea badge avatar scroll-area -y ``` ```bash # scripts/create-dashboard.sh:63-73 echo "my-app" | npx create-next-app@latest . --typescript --tailwind --eslint --app --src-dir --import-alias "@/*" --use-npm --yes 2>/dev/null || true log_info "Installazione dipendenze..." npm install recharts framer-motion lucide-react date-fns npm install next-themes log_info "Setup shadcn/ui..." npx shadcn@latest init -y -d npx shadcn@latest add button card input tabs badge avatar dropdown-menu -y ``` ```bash # scripts/create-website.sh:63-74 echo "my-app" | npx create-next-app@latest . --typescript --tailwind --eslint --app --src-dir --import-alias "@/*" --use-npm --yes 2>/dev/null || true log_info "Installazione dipendenze..." npm install framer-motion lucide-react clsx tailwind-merge log_info "Setup shadcn/ui..." npx shadcn@latest init -y -d npx shadcn@latest add button card input textarea badge avatar separator -y ``` ```bash # scripts/create-workflow.sh:66-75 npm install @modelcontextprotocol/sdk zod npm install -D typescript @types/node ts-node nodemon npm install node-cron express npm install -D @types/express @types/node-cron log_info "Setup TypeScript..." npx tsc --init --outDir ./dist --rootDir ./src ...[truncated 1916 chars]

Remediation

View remediation

/dev/null || true`; fail safely so a partial or unexpected installation is visible. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create-workflow.sh:644

Finding

Generated Webhook Server Executes Workflows Without Authentication

Content

View full analysis

{ const { workflow } = req.params const { event, data } = req.body try { const result = await engine.execute(workflow, { event, ...data }) res.json({ success: true, result }) } catch (error) { res.status(500).json({ success: false, error: (error as Error).message }) } }) ``` ```dotenv # scripts/create-workflow.sh:676-684 # API Keys for integrations OPENAI_API_KEY= ANTHROPIC_API_KEY= # Webhook secrets WEBHOOK_SECRET= # Database (optional) DATABASE_URL= ``` ### Technical Analysis The generated Express server accepts a workflow name and attacker-controlled JSON data, then directly invokes `engine.execute`. It does not authenticate the caller, verify a webhook signature, enforce authorization for the selected workflow, prevent replay, or validate the request body against a strict schema. Although the generated environment example declares `WEBHOOK_SECRET`, the server never reads or validates that value. This can give users the false impression that webhook authentication is supported. The sample workflows currently perform mostly placeholder operations, but the declared purpose is to let users add integrations, notifications, data processing, and automated actions. Once such actions are implemented, this unauthenticated endpoint becomes a direct remote trigger for them. ### Attack Path 1. A generated webhook server is started and exposed on a network-accessible interface or deployed publicly. 2. An attacker identifies port 3001 or the deployed `/webhook/:workflow` route. 3. The attacker submits a request such as: ```http POST /webhook/data-proce ...[truncated 1020 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create-ai-app.sh:110

Finding

Generated AI Chat Endpoint Allows Unauthenticated API-Credit Abuse

Content

View full analysis

({ role: m.role, content: m.content, })), }) const stream = OpenAIStream(response) return new StreamingTextResponse(stream) } ``` The script installs rate-limiting dependencies but does not apply them: ```bash # scripts/create-ai-app.sh:66-67 npm install ai openai @anthropic-ai/sdk framer-motion lucide-react npm install @upstash/redis @upstash/ratelimit ``` ### Technical Analysis The generated `/api/chat` route acts as a server-side proxy to OpenAI using the project owner's `OPENAI_API_KEY`. Any caller who can reach the endpoint can submit arbitrary message arrays and choose the `model` value. The route has no user authentication, authorization, rate limit, request-size restriction, message-count limit, token ceiling, model allowlist, or strict schema validation. Installing `@upstash/ratelimit` does not mitigate the issue because the generated route never imports or invokes it. The API key remains server-side and is not directly exposed by this code. The vulnerability is unauthorized use of the server's API privileges and billing account rather than direct credential disclosure. ### Attack Path 1. The generated application is deployed with a valid `OPENAI_API_KEY`. 2. An attacker discovers the public `/api/chat` endpoint. 3. The attacker sends repeated requests containing large prompts or requests an expensive model supported by the account. 4. The server accepts the requests without identifying or l ...[truncated 590 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/js/dashboard-widgets.js:30

Finding

DOM-Based Cross-Site Scripting Through Unsanitized Widget Content

Content

View full analysis

${widget.title}

${widget.refresh ? '↻' : ''} ×

`; ``` ```javascript // assets/js/dashboard-widgets.js:145-154 render: (el) => { const todos = JSON.parse(localStorage.getItem('todos') || '[]'); el.innerHTML = `

${todos.map(todo => `
• ${todo}
`).join('')}

`; ``` ### Technical Analysis The widget system interpolates `widget.title` and stored todo values directly into HTML strings assigned to `innerHTML`. No HTML escaping, structural validation, or sanitization is performed. Todo values are initially entered by the local user, but they are persisted in `localStorage`, which can also be modified by any same-origin script or through another same-origin vulnerability. Widget registration is likewise a generic API and may receive dynamic configuration. If an attacker can influence either value, browser-interpreted markup and event handlers can be injected. A representative payload is: ```html ``` If this value appears in the `todos` array or as a widget title, it is parsed as HTML instead of displayed as text. ### Attack Path 1. An attacker gains cont ...[truncated 1074 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a comprehensive builder system for creating production-ready websites, AI apps, dashboards, and workflows across a modern web stack. The supplied code instead implements a small front-end dashboard widget framework in plain JavaScript, with localStorage-backed layout/todo persistence and sample widgets (weather, clock, tasks). While 'dashboard' is loosely related, the actual code is only a limited dashboard widget component and lacks the core declared capabilities: no project scaffolding, no AI functionality, no workflow automation, and no evidence of the stated frameworks or integrations. This is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The description presents a unified builder for multiple project categories (websites, AI applications, dashboards, workflows) with MCP integration. The supplied code chunk instead performs a much narrower task: it creates a production scaffold for a Next.js AI chat application with streaming OpenAI responses and optional Anthropic configuration. While this partially aligns with the 'build AI app' aspect, it materially does not match the broader declared scope. The script does not implement dashboard generation, workflow automation, generic website creation, or MCP integration. Additionally, although it accepts --type chat|agent|rag and installs Upstash packages, the generated files only implement chat functionality, so the actual behavior is more limited than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad project-building system covering websites, AI apps, dashboards, workflows, and MCP integration. The supplied code only implements one narrow capability: creating a Next.js website starter. Its behavior aligns with the 'create website' portion of the description, but not with the broader claims about AI features, dashboards, workflows, or MCP. Because the actual code chunk is materially narrower than the declared primary purpose, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents a general-purpose builder for websites, AI applications, dashboards, and workflows, specifically mentioning Next.js, TypeScript, Tailwind, shadcn/ui, and MCP integration. The supplied code chunk is much narrower: it only scaffolds a workflow-focused Node.js/TypeScript project centered on MCP, workflow execution, scheduling, CLI commands, and a webhook server. While this partially aligns with the 'setup workflow' and MCP aspects, it materially fails to cover the broader advertised capabilities and triggers such as website creation, dashboard building, chat interfaces, and AI app generation. Therefore the description overstates and misrepresents the code's actual primary behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is very broad and includes generic phrases like 'create project', 'dashboard', and 'automation', which can cause the skill to activate in many unrelated user requests. In an agent environment with Write, Edit, Bash, and Node permissions, over-triggering can lead to unintended file changes, command execution, or the agent steering users into this skill when a narrower, safer tool should have been used.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/create-ai-app.sh (reported line 430)May include surrounding context.

sh

npm install

# Configure environment variables
cp .env.example .env.local
# Edit .env.local with your API keys

# Run development server

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/create-ai-app.sh (reported line 431)May include surrounding context.

sh

npm install

# Configure environment variables
cp .env.example .env.local
# Edit .env.local with your API keys

# Run development server

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/create-ai-app.sh (reported line 451)May include surrounding context.

sh

log_info "Tipo: $TYPE"
log_info "Per iniziare:"
echo "  cd $PROJECT_NAME"
echo "  cp .env.example .env.local"
echo "  # Aggiungi le tue API keys"
echo "  npm install"
echo "  npm run dev"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/create-website.sh (reported line 384)May include surrounding context.

sh

# Local env files
.env*.local
.env

# Vercel
.vercel

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/create-workflow.sh (reported line 109)May include surrounding context.

sh

: true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true,
    "resolveJsonModule": true,
    "declaration": true,
    "declarationMap": true,
    "sourceMap": true
  },
  "include": ["src/**/*"],
  "exclude": ["node_modules", "dist"]
}
EOF

# Crea package.json scripts
cat > package.json << 'EOF'
{
  "name": "mcp-workflow",
  "version": "1.0.0",
  "description": "MCP Workflow Server",
  "main": "dist/index.js",
  "type": "module",
  "scripts": {
    "build": "tsc",
    "dev": "nodemon --exec ts-node --esm src/index.ts",
    "start": "node dist/index.js",
    "workflow": "node dist/workflows/runner.js"
  },
  "keywords": ["mcp", "workflow", "automation"],
  "author": "",
  "license": "MIT"
}
EOF

# Crea server MCP base
cat > src/index.ts << 'EOF'
#!/usr/bin/env node
import { Server } from '@modelcontextprotocol/sdk/server/index.js'
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
import {
  CallToolRequest

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 84% confidence

Finding

The trigger phrase 'create website' overlaps with a common built-in command pattern and may shadow or intercept ordinary user requests. That ambiguity is risky because it can invoke a powerful project-building skill unexpectedly, resulting in unintended scaffolding, edits, or shell activity under the wrong context.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 84% confidence

Finding

The phrase 'create project' is highly generic and likely to collide with built-in or other skill invocation patterns. Because this skill is user-invocable and has access to filesystem and execution tools, accidental invocation can produce system-impacting actions that the user did not intend from a simple request.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 82% confidence

Finding

The trigger 'build application' is another broad phrase that can shadow normal assistant behavior around coding or build requests. In context, this is more dangerous because the skill advertises broad automation and has tool permissions that could translate ambiguous natural-language requests into real modifications or command execution.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 78% confidence

Finding

The trigger 'chat interface' is somewhat generic and may overlap with standard conversational intents, though it is less operationally dangerous than deployment-oriented triggers. Still, ambiguous invocation can misroute requests into a skill with broad tooling permissions and cause unnecessary project scaffolding or edits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill encourages deployment, webhook setup, third-party API use, and environment-variable-based credential handling, but it does not include explicit safety guidance around secrets, external exposure, cost, privacy, or system changes. In a build/deploy skill with Bash and Node access, missing warnings increase the chance of users unintentionally exposing credentials, deploying insecure defaults, or connecting production services without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script accepts and validates --type <chat|agent|rag> and reports the selected type to the user, implying different app variants will be produced. However, the generated files are always the same chat application, and no branch in the script changes output based on TYPE, which makes the script's user-facing intent inconsistent with its actual behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The script executes remote package code via npx create-next-app@latest, which intentionally pulls the newest version at runtime instead of a pinned, reviewed version. In a project-generation skill, this increases supply-chain risk because any upstream compromise or breaking change is executed immediately on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The script runs npx shadcn@latest init, which executes remote code from the registry at runtime without version pinning. Because this skill is meant to create production-ready apps, unpinned scaffolding code materially raises supply-chain exposure and makes builds non-reproducible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

A second unpinned npx shadcn invocation adds components by fetching and executing the latest package version at runtime. This compounds the same supply-chain risk and can result in inconsistent or malicious code being introduced into generated applications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated README advertises "Rate limiting con Upstash Redis" as an included feature, yet the script only installs Upstash packages and writes optional environment variables. No Redis client usage, middleware, or request-limiting logic is created anywhere in the generated app, so the documentation overstates the implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script performs directory creation, project initialization, multiple package installs, remote CLI execution, and many file writes immediately after argument parsing, without an upfront warning or confirmation. In a skill that may be triggered by natural-language project creation requests, this makes unintended execution and silent workspace modification more dangerous.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script executes npx create-next-app@latest, which fetches and runs remote package code at install time using a moving latest target. This creates a supply-chain risk: a compromised upstream release or unexpected breaking change could execute arbitrary code on the operator's machine when the skill is run.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script runs npx shadcn@latest init -y -d, which downloads and executes unpinned remote code non-interactively. Because this skill is a project generator intended for broad use, compromise of the upstream package or an unexpected release could immediately affect all users running the script.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/create-ai-app.sh:84

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/create-workflow.sh:528