A complex business system in 170k tokens. ObjectStack compresses an entire app — data model, UI, workflows, permissions — into typed metadata, an AI agent can hold in context, reason about, and refactor whole.
- capability exposure inferred + 35
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 7m ago · see ecosystem CVEs →
- D · 64 → C · 44
- C · 56 → D · 64
No known CVEs for this server.
- high dangerous code
committed secret: Slack token · dynamic exec: new Function() · credential logged in 1 file(s) · obfuscated payload: dynamic require()/import()
analyzed commit e9cb9ab · analyzer v31 · 23h ago
skills & prompt files 31
- skill objectstack-ai-objectstack-e9cb9ab/.claude/skills/checklist-author/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/.claude/skills/checklist-test/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/.claude/skills/dogfood-verification/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/.claude/skills/pm-dispatch/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/.claude/skills/spec-property-retirement/SKILL.md
- agent-rules objectstack-ai-objectstack-e9cb9ab/AGENTS.md
- agent-rules objectstack-ai-objectstack-e9cb9ab/CLAUDE.md
- agent-rules objectstack-ai-objectstack-e9cb9ab/content/docs/ai/agents.mdx
- agent-rules objectstack-ai-objectstack-e9cb9ab/content/docs/references/ai/agent.mdx
- skill objectstack-ai-objectstack-e9cb9ab/content/docs/references/ai/skill.mdx
- agent-rules objectstack-ai-objectstack-e9cb9ab/examples/AGENTS.md
- agent-rules objectstack-ai-objectstack-e9cb9ab/packages/create-objectstack/src/templates/AGENTS.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/README.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/architecture.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/create-new-project.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/implement-objectai.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/implement-objectos.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/implement-objectql.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/implement-objectui.md
- prompt-file objectstack-ai-objectstack-e9cb9ab/packages/spec/prompts/instructions.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-ai/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-api/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-automation/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-data/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-formula/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-i18n/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-platform/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-pm-dispatch/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-query/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-ui/SKILL.md
- skill objectstack-ai-objectstack-e9cb9ab/skills/objectstack-upgrade/SKILL.md
danger signals6
- dynamic code execution new Function() objectstack-ai-objectstack-e9cb9ab/examples/app-showcase/test/my-work-visibility.test.ts :59
const fn = new Function('current_user', `"use strict"; return (${source});`) as ( - dynamic code execution new Function() objectstack-ai-objectstack-e9cb9ab/examples/app-showcase/test/page-variables.test.ts :51
const fn = new Function('page', `"use strict"; return (${source});`) as ( - dynamic code execution new Function() objectstack-ai-objectstack-e9cb9ab/packages/services/service-automation/src/builtin/template.ts :115
const fn = new Function(`"use strict"; return (${safe});`); - committed secret Slack token objectstack-ai-objectstack-e9cb9ab/examples/app-showcase/objectstack.config.ts :146
xoxb-s…(24 chars, redacted) - committed secret Slack token objectstack-ai-objectstack-e9cb9ab/packages/connectors/connector-slack/src/connector-slack-plugin.test.ts :30
xoxb-s…(17 chars, redacted) - credential in logs credential in log objectstack-ai-objectstack-e9cb9ab/packages/plugins/plugin-auth/src/auth-plugin.ts :1462
ctx.logger.info(`🔑 Dev admin seeded: ${email} / ${password}`);
[](https://mcpobservatory.com/servers/github:objectstack-ai/objectstack/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of objectstack-ai.