ai.outlit/outlit
version 1.0.0
- scanned 2026-10-16
- source github.com/OutlitAI/outlit-sdk
- commit 9f1553137fd8
- transport streamable-http
- files read 192
- methodology 0.2.0
- ruleset 0.1.1
No tag matching version 1.0.0 was found in this repository, so the scan read the default branch instead. The findings below describe that code, not necessarily the released version.
38
88measured on 40% of this axis
0
77measured on 75% of this axis
41measured on 85% of this axis
The evidence
Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.
Code Safety
- .agents/skills/brainstorming/scripts/server.cjs:540mcp-js-shell-exec-nonliteral (critical/medium)
A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.
// Operator-provided launcher: run as given (this env var is trusted operator input). if (process.env.BRAINSTORM_OPEN_CMD) { try { cp.exec(process.env.BRAINSTORM_OPEN_CMD + ' ' + JSON.stringify(url), () => {}); } catch (e) { /* best effort */ } return; } - packages/browser/scripts/deploy.ts:123mcp-js-shell-exec-nonliteral (critical/medium)
A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.
try { execSync(cmd, { stdio: "inherit" }) console.log("\n Deployed successfully!") console.log(` URL: ${getPublicUrl(gcsPath)}\n`) - packages/browser/scripts/deploy.ts:192mcp-js-shell-exec-nonliteral (critical/medium)
A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.
if (config.environment === "version") { try { execSync(`gcloud storage ls "${getGcsUrl(gcsPath)}" 2>/dev/null`, { stdio: "pipe", }) - packages/browser/scripts/deploy.ts:192mcp-js-shell-exec-template-literal (critical/medium)
A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.
if (config.environment === "version") { try { execSync(`gcloud storage ls "${getGcsUrl(gcsPath)}" 2>/dev/null`, { stdio: "pipe", }) - packages/browser/src/tracker.ts:658mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
void (async () => { try { const response = await fetch(buildBootstrapUrl(this.apiHost, this.publicKey), { credentials: "omit", signal: controller.signal, - packages/browser/src/tracker.ts:891mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
// Fallback to fetch const response = await fetch(url, { method: "POST", headers: { - packages/node/src/transport.ts:69mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
try { const response = await fetch(url, { method: INGEST_METHOD, headers: { - scripts/sync-outlit-skill.mjs:97mcp-js-ssrf-nonliteral-url (medium/low)
An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.
async function upstreamFile(revision, path) { const url = `https://raw.githubusercontent.com/OutlitAI/skills/${revision}/${path}` const response = await fetch(url) if (!response.ok) throw new Error(`Could not fetch ${path}@${revision}: HTTP ${response.status}`) return new TextDecoder("utf-8", { fatal: true }).decode(await response.arrayBuffer())
Auth Posture
- authentication_model
no authentication appears in the source we fetched, but this server's network endpoint is a hosted remote, whose authentication can be enforced in front of its code — and no credential header is declared. An undeclared header is not an absent one, so `03` §4's "no authentication" band is not established.
- transport_security
declared endpoint(s) are HTTPS: https://mcp.outlit.ai/mcp, https://mcp.outlit.ai/w/{workspaceSlug}/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.
- secret_handling
detect-secrets matched 54 credential-shaped string(s), every one from a keyword or entropy heuristic (Base64 High Entropy String, Basic Auth Credentials, Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at .agents/skills/typescript-advanced-types/references/details.md:274; Secret Keyword at docs/cli/configuration.mdx:37; Hex High Entropy String at docs/openapi.json:17436; Base64 High Entropy String at docs/outlit.js:8; Hex High Entropy String at docs/skill-source.json:3; Hex High Entropy String at docs/skill-source.json:5; Hex High Entropy String at docs/skill-source.json:6; Hex High Entropy String at docs/skill-source.json:7; Secret Keyword at docs/superpowers/plans/2026-04-30-cli-source-listing.md:619; Secret Keyword at docs/superpowers/plans/2026-04-30-cli-source-listing.md:620; …and 44 more matches
- authorization_granularity
2 tool registration(s) detected — at or below `03` §4's threshold of 3, so there is no multi-tool surface to segregate
Dependency Health
Showing the 50 most severe of 104 findings on this axis. The score was computed over all of them — findings beyond the fourth of a severity still deduct at a tenth of their weight — so the remainder is omitted from this page, not from the arithmetic.
- bun.lockturbo 2.8.10 — GHSA-3qcw-2rhx-2726
direct, CVSS 9.8, fixed in 2.9.14
https://osv.dev/vulnerability/GHSA-3qcw-2rhx-2726 - bun.lockvitest 4.0.18 — GHSA-5xrq-8626-4rwp
direct, CVSS 9.8, fixed in 4.1.0
https://osv.dev/vulnerability/GHSA-5xrq-8626-4rwp - bun.lockprotobufjs 7.5.4 — GHSA-xq3m-2v4x-88gg
transitive, CVSS 9.8, fixed in 7.5.5
https://osv.dev/vulnerability/GHSA-xq3m-2v4x-88gg - bun.lock@mariozechner/pi-coding-agent 0.67.1 — GHSA-jfgx-wxx8-mp94
direct, CVSS 7.3
https://osv.dev/vulnerability/GHSA-jfgx-wxx8-mp94 - bun.lockbraces 3.0.3 — GHSA-vfj7-8cjw-p6xm
transitive, CVSS 8.7
https://osv.dev/vulnerability/GHSA-vfj7-8cjw-p6xm - bun.lockfast-xml-builder 1.1.4 — GHSA-5wm8-gmm8-39j9
transitive, CVSS 8.7, fixed in 1.1.7
https://osv.dev/vulnerability/GHSA-5wm8-gmm8-39j9 - bun.locksource-map-js 1.2.1 — GHSA-68fv-2mgg-jv7q
transitive, CVSS 8.7, fixed in 1.2.2
https://osv.dev/vulnerability/GHSA-68fv-2mgg-jv7q - bun.lockextract-zip 2.0.1 — GHSA-jmr9-qjv8-65gv
transitive, CVSS 8.6
https://osv.dev/vulnerability/GHSA-jmr9-qjv8-65gv - bun.lockbasic-ftp 5.2.2 — GHSA-c475-qrg2-pj4r
transitive, CVSS 8.2, fixed in 6.2.1
https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r - bun.locknanoid 3.3.11 — GHSA-28wg-ghj8-5hjv
transitive, CVSS 8.2, fixed in 3.3.16
https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv - bun.locknanoid 3.3.11 — GHSA-2v37-7h3g-55p8
transitive, CVSS 8.2, fixed in 3.3.18
https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8 - bun.lockvite 7.3.1 — GHSA-fx2h-pf6j-xcff
transitive, CVSS 8.2, fixed in 7.3.5
https://osv.dev/vulnerability/GHSA-fx2h-pf6j-xcff - bun.lockvite 7.3.1 — GHSA-p9ff-h696-f583
transitive, CVSS 8.2, fixed in 7.3.2
https://osv.dev/vulnerability/GHSA-p9ff-h696-f583 - bun.lockvite 7.3.1 — GHSA-v2wj-q39q-566r
transitive, CVSS 8.2, fixed in 7.3.2
https://osv.dev/vulnerability/GHSA-v2wj-q39q-566r - bun.lockextract-zip 2.0.1 — GHSA-7pqw-9j4j-h8q3
transitive, CVSS 8.1
https://osv.dev/vulnerability/GHSA-7pqw-9j4j-h8q3 - bun.lockprotobufjs 7.5.4 — GHSA-75px-5xx7-5xc7
transitive, CVSS 8.1, fixed in 7.5.6
https://osv.dev/vulnerability/GHSA-75px-5xx7-5xc7 - bun.lockbrace-expansion 5.0.5 — GHSA-3jxr-9vmj-r5cp
transitive, CVSS 7.7, fixed in 5.0.7
https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp - bun.lockip-address 10.1.0 — GHSA-mwp4-54f8-5fhr
transitive, CVSS 7.7, fixed in 10.3.1
https://osv.dev/vulnerability/GHSA-mwp4-54f8-5fhr - bun.lockprotobufjs 7.5.4 — GHSA-66ff-xgx4-vchm
transitive, CVSS 7.7, fixed in 7.5.6
https://osv.dev/vulnerability/GHSA-66ff-xgx4-vchm - bun.lockbasic-ftp 5.2.2 — GHSA-rp42-5vxx-qpwr
transitive, CVSS 7.5, fixed in 5.3.0
https://osv.dev/vulnerability/GHSA-rp42-5vxx-qpwr - bun.lockbasic-ftp 5.2.2 — GHSA-rpmf-866q-6p89
transitive, CVSS 7.5, fixed in 5.3.1
https://osv.dev/vulnerability/GHSA-rpmf-866q-6p89 - bun.lockbrace-expansion 5.0.5 — GHSA-6j4f-fj2g-mc7p
transitive, CVSS 7.5, fixed in 5.0.10
https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p - bun.lockbrace-expansion 5.0.5 — GHSA-mh99-v99m-4gvg
transitive, CVSS 7.5, fixed in 5.0.8
https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg - bun.lockbrace-expansion 5.0.5 — GHSA-qhr7-859c-m2p7
transitive, CVSS 7.5, fixed in 5.0.11
https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7 - bun.lockbrace-expansion 5.0.5 — GHSA-rgw5-rvv9-x895
transitive, CVSS 7.5, fixed in 5.0.9
https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895 - bun.lockfast-uri 3.1.0 — GHSA-4c8g-83qw-93j6
transitive, CVSS 7.5, fixed in 3.1.3
https://osv.dev/vulnerability/GHSA-4c8g-83qw-93j6 - bun.lockfast-uri 3.1.0 — GHSA-7p8r-x3mc-p8w7
transitive, CVSS 7.5, fixed in 3.1.5
https://osv.dev/vulnerability/GHSA-7p8r-x3mc-p8w7 - bun.lockfast-uri 3.1.0 — GHSA-f65p-4m7j-42xc
transitive, CVSS 7.5, fixed in 3.1.6
https://osv.dev/vulnerability/GHSA-f65p-4m7j-42xc - bun.lockfast-uri 3.1.0 — GHSA-jqff-g426-hqxp
transitive, CVSS 7.5, fixed in 3.1.6
https://osv.dev/vulnerability/GHSA-jqff-g426-hqxp - bun.lockfast-uri 3.1.0 — GHSA-q3j6-qgpj-74h6
transitive, CVSS 7.5, fixed in 3.1.1
https://osv.dev/vulnerability/GHSA-q3j6-qgpj-74h6 - bun.lockfast-uri 3.1.0 — GHSA-qw65-cvwx-89v3
transitive, CVSS 7.5, fixed in 3.1.7
https://osv.dev/vulnerability/GHSA-qw65-cvwx-89v3 - bun.lockfast-uri 3.1.0 — GHSA-v2hh-gcrm-f6hx
transitive, CVSS 7.5, fixed in 3.1.4
https://osv.dev/vulnerability/GHSA-v2hh-gcrm-f6hx - bun.lockfast-uri 3.1.0 — GHSA-v39h-62p7-jpjc
transitive, CVSS 7.5, fixed in 3.1.2
https://osv.dev/vulnerability/GHSA-v39h-62p7-jpjc - bun.lockjs-yaml 3.14.2 — GHSA-2883-xcg3-v3hh
transitive, CVSS 7.5, fixed in 3.15.2
https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh - bun.lockjs-yaml 4.1.1 — GHSA-2883-xcg3-v3hh
transitive, CVSS 7.5, fixed in 4.3.2
https://osv.dev/vulnerability/GHSA-2883-xcg3-v3hh - bun.lockjs-yaml 3.14.2 — GHSA-52cp-r559-cp3m
transitive, CVSS 7.5, fixed in 3.15.0
https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m - bun.lockjs-yaml 4.1.1 — GHSA-52cp-r559-cp3m
transitive, CVSS 7.5, fixed in 4.3.0
https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m - bun.lockjs-yaml 3.14.2 — GHSA-5p4m-2wfm-xmqj
transitive, CVSS 7.5, fixed in 3.15.1
https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj - bun.lockjs-yaml 4.1.1 — GHSA-5p4m-2wfm-xmqj
transitive, CVSS 7.5, fixed in 4.3.1
https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj - bun.lockpicomatch 2.3.1 — GHSA-c2c7-rcm5-vvqj
transitive, CVSS 7.5, fixed in 2.3.2
https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj - bun.lockpicomatch 4.0.3 — GHSA-c2c7-rcm5-vvqj
transitive, CVSS 7.5, fixed in 4.0.4
https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj - bun.lockpostcss 8.5.6 — GHSA-6g55-p6wh-862q
transitive, CVSS 7.5, fixed in 8.5.12
https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q - bun.lockpostcss 8.5.6 — GHSA-r28c-9q8g-f849
transitive, CVSS 7.5, fixed in 8.5.18
https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849 - bun.lockprotobufjs 7.5.4 — GHSA-685m-2w69-288q
transitive, CVSS 7.5, fixed in 7.5.6
https://osv.dev/vulnerability/GHSA-685m-2w69-288q - bun.lockprotobufjs 7.5.4 — GHSA-jvwf-75h9-cwgg
transitive, CVSS 7.5, fixed in 7.5.6
https://osv.dev/vulnerability/GHSA-jvwf-75h9-cwgg - bun.lockprotobufjs 7.5.4 — GHSA-wcpc-wj8m-hjx6
transitive, CVSS 7.5, fixed in 7.6.1
https://osv.dev/vulnerability/GHSA-wcpc-wj8m-hjx6 - bun.lockundici 7.22.0 — GHSA-f269-vfmq-vjvj
transitive, CVSS 7.5, fixed in 7.24.0
https://osv.dev/vulnerability/GHSA-f269-vfmq-vjvj - bun.lockundici 7.22.0 — GHSA-rfgv-xxqx-mfg5
transitive, CVSS 7.5, fixed in 7.29.1
https://osv.dev/vulnerability/GHSA-rfgv-xxqx-mfg5 - bun.lockundici 7.22.0 — GHSA-v9p9-hfj2-hcw8
transitive, CVSS 7.5, fixed in 7.24.0
https://osv.dev/vulnerability/GHSA-v9p9-hfj2-hcw8 - bun.lockundici 7.22.0 — GHSA-vrm6-8vpv-qv8q
transitive, CVSS 7.5, fixed in 7.24.0
https://osv.dev/vulnerability/GHSA-vrm6-8vpv-qv8q
Maintenance
- recency
last commit 2 day(s) before 2026-10-16
- issue_responsiveness
lifetime median (1 issue(s) in the last 6 months, under `03` §5's floor of 3): 21.2 day(s) to first maintainer comment
- release_cadence
released 2 day(s) ago (by releases), inside `03` §5's 30-day window
- bus_factor
this repository's 12-month history is longer than the bounded walk `04` §7 performs, and the authors found so far span more than one of `03` §5's bands. A limit of ours, not a finding about the server.
- repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.
Transparency
- license
LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text
- readme_quality
README.md: installation instructions (+25), configuration documented (+25), states what the server does in the first 200 words (+20)
- declared_scopes
neither the README nor the MCP manifest documents what the server accesses or what side effects it has
- changelog
the only changelog is packages/pi/CHANGELOG.md, inside a nested sub-project with its own package manifest — it describes that project, and whether it also covers this server cannot be told from the tree
- security_contact
no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately
Contest a finding
Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.
Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.