open-mcp-apps-persistent-ui
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation recommends installation via
curl -fsSL https://raw.githubusercontent.com/2nd1st/open-mcp-apps/main/install.sh | sh. Piped shell execution from untrusted sources is a critical vulnerability that allows arbitrary code execution on the user's host without inspection. - [EXTERNAL_DOWNLOADS]: The skill depends on code hosted at
https://github.com/2nd1st/open-mcp-apps, which is an external, untrusted repository not managed by the skill vendor ('reason-machines') or any trusted organization. - [DYNAMIC_EXECUTION]: The skill facilitates the runtime generation and execution of HTML and JavaScript code through the
save_apptool. These 'apps' are then executed by an engine that provides them with an API for file system interaction and database access. - [INDIRECT_PROMPT_INJECTION]: The skill creates a significant attack surface where untrusted user input or external data processed by the AI could lead to the generation of malicious UI components.
- Ingestion points: User prompts requesting the creation or modification of UI components (e.g., 'make a habit tracker').
- Boundary markers: Absent; there are no instructions to sanitize or validate the content of the generated HTML apps before they are saved and executed.
- Capability inventory: The generated apps have access to a privileged API (
window.oma) includingwindow.oma.filesfor file management andmutatefor database changes. - Sanitization: Absent; the skill relies on the AI to produce safe code manually.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/2nd1st/open-mcp-apps/main/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata