Skill

convert-web-app

skill:tldraw/tldraw#convert-web-app

This skill should be used when the user asks to "add MCP App support to my web app", "turn my web app into a hybrid MCP App", "make my web page work as an MCP App too", "wrap my existing UI as an MCP App", "convert iframe embed to MCP App", "turn my SPA into an MCP App", or needs to add MCP App support to an existing web application while keeping it working standalone. Provides guidance for analyzing existing web apps and creating a hybrid web + MCP App with server-side tool and resource registration.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:06 UTC at 48c9de8

findings

high

highest severity

threat classes

4,840

files scanned

91/91

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:apps/mcp-app/.claude/skills/convert-web-app:apps/mcp-app/.claude/skills/convert-web-app/SKILL.md:26:SUPPLY
suspicious: finding skill:apps/mcp-app/.claude/skills/convert-web-app:apps/mcp-app/.claude/skills/convert-web-app/SKILL.md:538:EXEC

Security findings 2

Code execution

highContextual risklow confidence

The skill instructs the agent to install and run the basic-host example from the externally cloned repository to test the converted app, executing remotely fetched code on the host.

apps/mcp-app/.claude/skills/convert-web-app/SKILL.md:538-545

SERVERS='[

vector:instruction

Counter-argument considered

The strongest case against this finding is that running the official SDK's basic-host example is a standard, openly documented testing step and the npm install pulls from the official registry, invoking the pinned official-registry carve-out; but the code executed is fetched by git clone at a runtime-resolved version, not a pinned registry install, and the artifact does not pin those dependencies. Execution from the cloned repo is a concrete source-to-sink chain, and no declared claim (D1/D2 example assets, D8 SERVERS URLs) declares running code fetched from github.com, so the finding stands.

Supply chain

mediumContextual risklow confidence

The skill instructs the agent to clone the official MCP SDK repository from GitHub at a version branch resolved at runtime into /tmp and then read and adapt its source files and examples as guidance, so the instructions the agent follows depend on remote content fetched at execution time.

apps/mcp-app/.claude/skills/convert-web-app/SKILL.md:26

git clone --branch

vector:instruction

Counter-argument considered

The strongest case against this finding is that the clone targets the official modelcontextprotocol org and the version comes from the official npm registry, invoking the pinned official-registry carve-out; but the reference is resolved at runtime rather than pinned to an immutable version, and the skill then directs the agent to read and adapt the cloned sources as guidance, so the carve-out does not neutralize it. The behavior is in the skill body, is a remote-content-to-agent-instructions chain, and the request's own residue analysis flags network 'github.com' as undeclared (declared claims D1/D2 cover only example apps' external assets, D8 only SERVERS URLs), so the low-confidence contextual_risk finding stands.