tauri-mcp-server-development

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill exposes high-risk capabilities — arbitrary JavaScript execution in webviews, IPC command execution/emit, full DOM snapshots and screenshots, log and IPC traffic capture, and a controllable WebSocket driver/session (configurable host/port) — which, if misused or misconfigured, enable data exfiltration, credential harvesting, and remote control/backdoor behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill launches the MCP server via npx (e.g., "npx -y @hypothesi/tauri-mcp-server"), which fetches and executes remote npm package code (https://www.npmjs.com/package/@hypothesi/tauri-mcp-server) at runtime and is required for the skill to operate, so it constitutes a runtime external dependency that executes remote code.