registry / @frontmcp/plugin-skilled-openapi / 1.5.4

@frontmcp/plugin-skilled-openapi@1.5.4

FrontMCP plugin: serve a customer's OpenAPI spec as skill bundles (signed, OpenAPI-Overlay-based) with hidden per-operation tools mediated by three meta-tools (search_skill / load_skill / run_workflow — the last runs an enclave-sandboxed AgentScript that

Static Scan Results

scanned 9h ago · by rust-scanner

Static analysis flagged 2 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 138 KB of source

Source & flagged code

1 flagged

esm/index.mjsView file

Lines 191-231javascript

191 }

192 /** Default-deny policy for ops with no required-authorities (C1/C3). */

193 get unprotectedOps() {

194 return this.options.unprotectedOps;

195 }

196};

197var SkilledOpenApiCredentialResolver

Source & flagged code

1 flagged · loading source

esm/index.mjsView file

211/** L212: * Allow outbound connections to private/loopback/link-local IPs. L213: * MUST stay false in production. Set true only for self-hosted scenarios ... L885: try { L886: const { promises: dns } = await import("node:dns"); L887: addresses = await dns.lookup(literal.ip, { all: true }); ... L927: } else { L928: token = await resolver.resolve(binding.vaultRef, { bundleId }); L929: if (!token) throw new Error(`bearer vaultRef "${binding.vaultRef}" did not resolve`); ... L982: mapper: [...op.mapper, ...securityMapper], L983: metadata: { L984: path: op.pathTemplate,

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code