App Builder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This app-building skill is mostly purpose-aligned, but it gives agents broad deployment and secret-handling instructions without enough scoping or approval controls.

Review before installing. This skill may create private GitHub repos, push directly to main, deploy to Vercel production, run unpinned npm packages via npx, and copy local environment variables into Vercel. Use it only if you are comfortable with those actions, and prefer approving repo creation, pushes, deployments, package versions, and individual secret names explicitly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:32

Finding

Unpinned Third-Party Packages Are Downloaded and Executed via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-40
Vulnerability Type: Unpinned executable dependencies
Risk Level: High

Complete Code Snippet:

markdown

2. **Create an Instant appId + token**
   - Run:
     - `npx instant-cli init-without-files`
   - Capture the returned `appId` and `token`.

3. **Generate the Next.js app**
   - Run this from inside `~/apps` (because the command creates the project folder):
     - `cd ~/apps`
     - `npx create-instant-app <app-name> --next --codex --app <appId> --token <token>`

Technical Analysis

The skill instructs the agent to invoke instant-cli and create-instant-app through npx without pinning reviewed versions or requiring integrity verification. If the packages are unavailable locally, npx can retrieve and immediately execute package contents from the configured npm registry.

Because no exact versions, lockfile constraints, checksums, or provenance requirements are specified, the executable payload may change after the skill has been reviewed. A compromised maintainer account, malicious package release, registry compromise, or unsafe registry configuration could cause attacker-controlled package or lifecycle code to execute with the local user's permissions. The generator command also receives the Instant token as a command-line argument, placing that credential within reach of the executed package.

Attack Path

1. An attacker compromises a referenced npm package, its publisher account, its release process, or the configured package registry.
2. The attacker publishes a malicious version under the expected package name.
3. The agent follows the skill and runs an unversioned npx instant-cli or npx create-instant-app command.
4. npx resolves and executes the malicious package version.
5. The package reads accessible files, environment variables, cached credentials, or the Instant token passed to the generator.

...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every executable npm package to an exact, reviewed version, such as npx --yes instant-cli@X.Y.Z.
• Record approved versions and integrity information in project-controlled configuration or a lockfile.
• Verify package ownership, provenance, signatures where supported, and registry configuration before execution.
• Prefer installing dependencies from a locked manifest and running their local binaries rather than dynamically resolving the latest release.
• Execute generators with restricted filesystem and network access where practical.
• Use short-lived, least-privileged credentials and rotate the Instant token if execution integrity is uncertain.
• Avoid passing secrets on the command line when the tool supports a protected input mechanism, because command arguments may be visible through process inspection or logs.
• Review generated files and dependency changes before committing, pushing, or deploying them.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:77

Finding

Local Environment Variables May Be Uploaded to Vercel Without Secret Selection Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-79
Vulnerability Type: Unsafe handling and remote propagation of sensitive configuration
Risk Level: Medium

Complete Code Snippet:

markdown

## Environment variables (.env)

When you first push to vercel, it likely won't have environment variables. Use the CLI to push the environment variables you do have in the local .env file.

Technical Analysis

The instruction broadly directs the agent to push environment variables present in a local .env file to Vercel. It does not require an explicit allowlist, classify secrets by purpose, verify the destination account and project, distinguish development values from production values, or obtain approval for individual variable names.

A local .env file may contain unrelated credentials, personal tokens, development database passwords, administrative secrets, or variables intended only for local use. Copying all available values to a remote deployment platform unnecessarily expands their exposure. Although Vercel is a task-relevant deployment destination and the text does not demonstrate malicious exfiltration, the absence of selection and authorization controls constitutes unsafe secret handling.

Attack Path

1. A local application .env file contains both deployment-required variables and unrelated or development-only secrets.
2. The agent follows the blanket instruction to push the locally available environment variables.
3. The Vercel CLI is linked to an incorrect, shared, or more broadly accessible project, or excessive variables are uploaded to the intended project.
4. The secrets become available to project members, deployment processes, or application code with access to the selected environment.
5. A malicious collaborator, compromised deployment, vulnerable application component, or account takeover exposes or abuses those credentials.

Impact Assessment

The obtainable pri ...[truncated 461 chars]

Remediation

View remediation

Remediation Suggestions

• Replace blanket .env upload guidance with an explicit allowlist of variables required by the application.
• Derive required variable names from reviewed application configuration and deployment documentation.
• Present variable names, but never secret values, for user approval before remote upload.
• Verify the active Vercel account, team, project, and target environments before changing configuration.
• Separate development, preview, and production values and apply each secret only to its required environment.
• Exclude personal tokens, local-only settings, administrative credentials, and unrelated service secrets.
• Use least-privileged, environment-specific, and short-lived credentials where supported.
• Do not print secret values in command output, progress messages, logs, commits, or audit artifacts.
• Document rotation and revocation procedures, and rotate any credential uploaded to an unintended destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs pushing values from the local .env file to Vercel with no warning, filtering guidance, or user confirmation. This can cause accidental transmission of unrelated local secrets, development credentials, or machine-specific tokens to a third-party service and persist them in a deployment environment.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The instruction to use local .env contents for Vercel deployment creates a credential-access pathway because .env files commonly contain API keys, tokens, database credentials, and other secrets. In this skill context, the danger is elevated because the agent is also instructed to deploy and manage external services, making exfiltration or oversharing of secrets more likely if performed automatically.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

## Environment variables (.env)

When you first push to vercel, it likely won't have environment variables. Use the CLI to push the environment variables you do have in the local .env file.

## Notes / guardrails

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The manifest/metadata references npx instant-cli without a version constraint, reinforcing dynamic resolution of a mutable external package. In a skill intended for repeated automated use, this increases the chance of supply-chain compromise and non-reproducible behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill instructs use of npx instant-cli without pinning a specific package version, which means execution may pull the latest published package at runtime. In a high-privilege workflow that creates apps, handles tokens, and deploys to GitHub/Vercel, a compromised or breaking upstream release could execute unintended code or alter behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description is broad enough to match many normal app-development requests, increasing the chance this skill is invoked in situations the user did not specifically intend. Because the skill can create repos, push code, and deploy to Vercel, overbroad triggering materially expands the blast radius of mistaken or unnecessary automation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

Referencing npx instant-cli as an available tool without version pinning creates a supply-chain and reproducibility risk because the invoked code is not fixed to a known-good release. Given this skill's deployment and repo-management scope, an unexpected package update could affect secrets, code, or deployment targets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The workflow explicitly tells the agent to run npx instant-cli init-without-files without a version pin, causing runtime retrieval of code from the package registry. Because this step returns app credentials and is part of an automated provisioning flow, compromise of the package or a malicious update could expose or misuse sensitive values.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The command npx create-instant-app <app-name> --next --codex --app <appId> --token <token> is unpinned and includes sensitive parameters on the command line. An upstream package change or compromise could directly access the provided app token and generate unsafe project contents or exfiltrate secrets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.