convert-web-app

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
1
Flagged
1
Chunks
3
Flagged Files (1)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/3] Description: --- name: convert-web-app description: This skill should be used when the user asks to "add MCP App support to my web app", "turn my web app into a hybrid MCP App", "make my web page work as an MCP App too", "wrap my existing UI as an MCP App", "convert iframe embed to MCP App", "turn my SPA into an MCP App", or needs to add MCP App support to an existing web application while keeping it working standalone.

Tool: SKILL.md [2/3] Description: = "ui://my-app/mcp-app.html"; // Register the tool — inputSchema maps to the app's data sources registerAppTool(server, "show-app", { description: "Displays the app with the given parameters", inputSchema: { query: z.string().describe("The search query") }, _meta: { ui: { resourceUri } }, }, async (args) => { // Process args server-side if needed return { content: [{ type: "text", text: `Showing app for: ${args.query}` }], structuredContent: { query: args.query

Tool: SKILL.md [3/3] Description: { app } = useApp({ appInfo, capabilities, onAppCreated }); useHostStyles(app); ``` **Using variables in CSS** — use `var()` with fallbacks so standalone mode still looks right: ```css .container { background: var(--color-background-secondary, #f5f5f5); color: var(--color-text-primary, #333); font-family: var(--font-sans, system-ui); border-radius: var(--border-radius-md, 8px); } ``` Key variable groups: `--color-background-*`, `--color-text-*`, `--color-border-*

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
1
Files Flagged
1
Chunks Analyzed
3
Analyzed
Feb 21, 2026, 11:45 PM
Security Audit — runlayer — convert-web-app