add-app-to-server

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
1
Flagged
1
Chunks
2
Flagged Files (1)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/2] Description: --- name: add-app-to-server description: This skill should be used when the user asks to "add an app to my MCP server", "add UI to my MCP server", "add a view to my MCP tool", "enrich MCP tools with UI", "add interactive UI to existing server", "add MCP Apps to my server", or needs to add interactive UI capabilities to an existing MCP server that already has tools.

Tool: SKILL.md [2/2] Description: const html = await fs.readFile( path.resolve(import.meta.dirname, "dist", "mcp-app.html"), "utf-8", ); return { contents: [{ uri: resourceUri, mimeType: RESOURCE_MIME_TYPE, text: html }] }; }); ``` If multiple tools share the same UI, they can reference the same `resourceUri` and the same resource registration.

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
1
Files Flagged
1
Chunks Analyzed
2
Analyzed
Feb 21, 2026, 11:45 PM
Security Audit — runlayer — add-app-to-server