xmind

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:18 AM UTC
• Version: 0.1.1

Overview

The skill does what it claims, but users should be aware it runs a pinned third-party npm MCP server and may save generated files to the Desktop by default.

Install only if you are comfortable running the pinned xmind-generator-mcp npm package through npx. For sensitive mind maps, specify an explicit output folder and use a sandboxed or low-privilege agent environment so the MCP process only has access to files you intend to provide.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Automatic Execution of an Unverified Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:35-40
Vulnerability Type: Supply-chain risk from automatic third-party package retrieval and execution
Risk Level: Medium

bash

mcporter call --stdio "npx -y xmind-generator-mcp@0.1.2" generate-mind-map --args '{...}'

Read XMind (Markdown export)

bash

mcporter call --stdio "npx -y xmind-generator-mcp@0.1.2" read-mind-map --args '{"inputPath":"/path/to/file.xmind","style":"A"}'

Technical Analysis

The skill directs the Agent to invoke npx -y, which can download and execute the xmind-generator-mcp npm package automatically without interactive approval. Pinning the dependency to version 0.1.2 reduces exposure to later package updates, but it does not cryptographically verify the retrieved artifact or establish that the package implementation and its transitive dependencies are trusted.

The executed MCP server runs as a local process with the permissions and environment inherited from the Agent. It receives user-controlled mind-map content, local input paths, and output paths. Consequently, compromise of the named npm release, its transitive dependencies, the registry delivery path, or the local npm cache could turn an apparently legitimate generation or reading operation into arbitrary local code execution.

The project contains no embedded implementation of this package, reviewed lockfile, integrity hash, sandbox policy, filesystem allowlist, environment-variable filtering, or network restriction that would constrain the dependency after execution.

Attack Path

1. An attacker compromises the published xmind-generator-mcp@0.1.2 artifact, one of its transitive dependencies, the package delivery path, or a package source/cache trusted by npx.
2. A user asks the Agent to generate or read an XMind file.
3. Following SKILL.md, the Agent executes npx -y xmind-generator-mcp@0.1.2 through mcporter.
4. npx retrieves or resolves ...[truncated 1243 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor or locally install a reviewed copy of the MCP server instead of downloading it during each skill invocation.
2. Maintain the dependency and all transitive dependencies in a committed lockfile with npm integrity hashes.
3. Verify the package tarball against an independently recorded cryptographic digest before installation or execution.
4. Disable package lifecycle scripts during installation unless they have been specifically reviewed and are required.
5. Run the MCP server in a dedicated sandbox or container with:
   • A read-only root filesystem.
   • Explicitly mounted input and output directories only.
   • No access to unrelated home-directory content.
   • A minimal, filtered environment without credentials or tokens.
   • Network access disabled by default or restricted to an explicit allowlist.
   • A non-privileged user and resource limits.
6. Validate and canonicalize all input and output paths before passing them to the MCP server, enforcing an approved directory allowlist.
7. Perform source and dependency review of xmind-generator-mcp@0.1.2 before approving it for use, and continuously monitor the package for ownership changes, advisories, and integrity changes.
8. Replace the npx -y runtime command with a reviewed, locally pinned executable so package resolution cannot silently introduce different code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute npx -y clawhub without pinning an exact package version. Because npx resolves the latest published package by default, a compromised upstream release or unexpected breaking update could cause users to run unreviewed code at publish/login time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The command npx -y clawhub whoami also relies on an unpinned package resolution path. If the clawhub package is replaced, hijacked, or updated maliciously, users may execute attacker-controlled code during an authentication-related workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The publish step uses npx -y clawhub publish ... without version pinning, which creates a supply-chain risk at the exact point where credentials and package contents may be handled. In skill-publishing context this is somewhat more sensitive because a malicious package could steal auth tokens, alter published artifacts, or tamper with release metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the assistant to write generated files to ~/Desktop by default when the user does not specify a path, which causes a local side effect without explicit user consent. This can unexpectedly place files in a visible, synced, or monitored location, creating privacy and safety risks, especially if the generated content is sensitive or if repeated writes clutter or overwrite user workspace expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.