MCP server

ly.img/codesign

mcp:imgly/codesign

Local design engine for AI agents: create, edit and export real, editable designs.

awesome-mcp-servers Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 11:52 UTC at a9f3307

findings

—

highest severity

threat classes

files scanned

1,178/1,178

checks satisfied

package advisories

Why this verdict

mcp-server . Inconclusive

inconclusive: gap no_tools_extracted at server.json

plugin plugins/codesign Inconclusive

benign: 101 checks satisfied, no findings for plugin:plugins/codesign

skill plugins/codesign/skills/animate No issues found

benign: 57 checks satisfied, no findings for skill:plugins/codesign/skills/animate

skill plugins/codesign/skills/api Inconclusive

inconclusive: gap parse_error at plugins/codesign/skills/api/signatures-extended.d.ts

skill plugins/codesign/skills/brand No issues found

benign: 109 checks satisfied, no findings for skill:plugins/codesign/skills/brand

skill plugins/codesign/skills/create No issues found

benign: 42 checks satisfied, no findings for skill:plugins/codesign/skills/create

skill plugins/codesign/skills/formats No issues found

benign: 82 checks satisfied, no findings for skill:plugins/codesign/skills/formats

skill plugins/codesign/skills/handbook No issues found

benign: 225 checks satisfied, no findings for skill:plugins/codesign/skills/handbook

skill plugins/codesign/skills/judge No issues found

benign: 39 checks satisfied, no findings for skill:plugins/codesign/skills/judge

skill plugins/codesign/skills/launch-video No issues found

benign: 57 checks satisfied, no findings for skill:plugins/codesign/skills/launch-video

skill plugins/codesign/skills/layerize No issues found

benign: 18 checks satisfied, no findings for skill:plugins/codesign/skills/layerize

skill plugins/codesign/skills/localize No issues found

benign: 127 checks satisfied, no findings for skill:plugins/codesign/skills/localize

skill plugins/codesign/skills/models No issues found

benign: 56 checks satisfied, no findings for skill:plugins/codesign/skills/models

skill plugins/codesign/skills/onboard No issues found

benign: 23 checks satisfied, no findings for skill:plugins/codesign/skills/onboard

skill plugins/codesign/skills/resize No issues found

benign: 40 checks satisfied, no findings for skill:plugins/codesign/skills/resize

skill plugins/codesign/skills/video-thumbnail-template No issues found

benign: 26 checks satisfied, no findings for skill:plugins/codesign/skills/video-thumbnail-template

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 3 candidate findings were refuted on review.

Refuted findings 3

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

criticalRefutedlow confidence

The skill's asset-loading guide tells the agent to load brand fonts from a jsDelivr URL pinned to the mutable `@main` branch of google/fonts; this is a font-loading network dependency for the declared brand-font purpose, but the content behind the URL can change.

plugins/codesign/skills/brand/reference/asset-loading.md:19

https://cdn.jsdelivr.net/gh/google/fonts@main/ofl/<dir>/<File>.ttf

Why it was refuted

The jsDelivr font URL is the declared core mechanism for brand-font loading, and it is stated openly in the guide. It fetches TTF font data, not code or instructions, so no harm or undeclared behavior remains beyond the unpinned @main ref. The detector's 'undeclared network' residue is wrong, since the network use is declared in the same unit.

Supply chain

criticalRefutedlow confidence

The skill tells the agent to set font URIs to a mutable branch URL (google/fonts@main via jsDelivr), so the font file the scene loads depends on whatever is on that branch at runtime.

plugins/codesign/skills/localize/reference/font-loading.md:16

https://cdn.jsdelivr.net/gh/google/fonts@main/ofl/<family-dir>/<FontFile>.ttf

Why it was refuted

Loading non-Latin fonts from the jsDelivr google/fonts mirror is the declared core capability of the localize skill, and the guide states it openly. The fetched content is a TTF font file, not code or agent instructions, so the mutable @main ref gives no concrete harm path.

Supply chain

criticalRefutedlow confidence

The font-loading guide tells the agent to load font binaries from a jsDelivr mirror pinned to the mutable `@main` branch of google/fonts, so fetched assets can change over time; this is plausibly the honest mechanism for the declared non-Latin font loading, and the URL serves font files rather than code or instructions.

plugins/codesign/skills/localize/reference/font-loading.md:18

https://cdn.jsdelivr.net/gh/google/fonts@main/ofl/<family-dir>/<FontFile>.ttf

Why it was refuted

Same behavior as the previous finding: the declared font-source URL serves font binaries for the stated purpose. The detector's 'undeclared network' and 'contradiction' leads are wrong, since the network source is declared in D21 and the contradicted claims are unrelated letter-spacing rules.

Coverage gaps 2

Parts of the artifact the static analysis could not fully examine.

no_tools_extracted MCP server target with no statically extractable tools/prompts/resources

server.json

parse_error tree-sitter typescript parse has errors; extraction may be partial

plugins/codesign/skills/api/signatures-extended.d.ts