ClawHub
Back to skill

Security audit

Indexbind

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent guide for installing and using indexbind, with a notable but disclosed npm supply-chain risk from unpinned install and npx examples.

Before installing, prefer a pinned indexbind version or a project-local dependency with a lockfile, avoid global install unless needed, and run indexing only on directories you intend to make searchable.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned npm Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–34
Vulnerability Type: Unpinned third-party dependency and unsafe package execution guidance
Risk Level: Medium

Vulnerable Code

markdown
## Install

Install the package:

```bash
npm install indexbind

Optional global install when the goal is using indexbind as a shell command from arbitrary directories:

bash
npm install -g indexbind

Then use either:

  • npx indexbind ... for local installs and per-project workflows
  • indexbind ... after a global install
text

### Technical Analysis

The Skill instructs users or agents to install `indexbind` without an exact version or verified integrity value. Package resolution therefore depends on the npm registry state at installation time, rather than on the version that was reviewed when this Skill was published.

npm packages can execute lifecycle scripts during installation. If the package, one of its transitive dependencies, or the associated publisher account is compromised, `npm install indexbind` may execute newly published attacker-controlled code with the privileges of the invoking user. The global installation recommendation increases exposure by placing package executables in a shared npm prefix and making the command available outside the current project.

The audited project does not contain the package implementation, a lockfile, integrity hashes, or provenance information. Consequently, the behavior of the installed dependency is outside the reviewed artifact and can change independently of this Skill.

### Attack Path

1. An attacker compromises the `indexbind` npm publisher account, compromises a transitive dependency, or causes a malicious release to be selected from the registry.
2. The attacker publishes a new package version containing a malicious lifecycle script or executable.
3. A user or agent follows the Skill and runs `npm install indexbind`, `npm i
...[truncated 1009 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version, for example npm install --save-exact indexbind@<reviewed-version>, rather than resolving the latest available release.
  2. Maintain and commit an npm lockfile containing integrity hashes for project-based installations, and use npm ci in reproducible environments.
  3. Verify npm package provenance, publisher identity, release signatures where available, and the dependency tree before recommending a version.
  4. Prefer a local project installation over npm install -g; remove the global-install recommendation unless it is operationally necessary.
  5. Review package lifecycle scripts and consider disabling them with --ignore-scripts when the package can function without installation scripts.
  6. Run package installation and execution with least privilege in an isolated environment that does not expose unrelated credentials or sensitive files.
  7. Establish a controlled update process in which new package versions and transitive dependency changes are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx indexbind without pinning a specific package version. npx may resolve and execute the latest published package at runtime, which creates a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly between runs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This line recommends npx indexbind ... for shell usage without a version constraint. That allows execution of whatever version is current in the registry at the time of use, exposing users to package hijack, compromised releases, or unexpected breaking changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The unpinned npx indexbind ... command can fetch and run a package version that was not reviewed when the skill was authored. In a skill whose purpose is to guide installation and execution, this meaningfully increases supply-chain exposure because the command is likely to be copied directly by users or agents.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This CLI example uses npx indexbind build ./docs without a pinned version. Because npx can retrieve the latest registry package and execute it immediately, an attacker controlling or compromising a future release could achieve arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This example invokes an unpinned npx package for building bundles. That creates a realistic supply-chain execution path because users often copy documentation commands verbatim, and the package may run with access to local files in the indexed directory.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The command npx indexbind update-cache ./docs --git-diff is unpinned and may execute an unreviewed package version. Since this workflow interacts with repository contents and diff state, compromise could expose local source material or modify artifacts unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This generic build example relies on npx without a fixed version. Floating execution in documentation is dangerous because package contents can change over time, turning a harmless example into a code execution vector via registry compromise or typosquatting confusion.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The build-bundle example is another unpinned npx execution path. In the context of a skill that teaches command usage, this is more dangerous than a passive reference because it is prescriptive operational guidance that may be executed on developer machines or CI systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This update-cache command executes indexbind via unpinned npx, which can resolve to changing package versions over time. That weakens reproducibility and introduces a supply-chain risk, especially for automated workflows that may run with repository or credential access.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The export-artifact example uses npx without version pinning, allowing arbitrary future package versions to be executed. If the package or registry account were compromised, users following this documentation could run attacker-controlled code while handling local artifact files.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This export-bundle example presents an unpinned npx command that can execute whatever version is current at runtime. Because exporting bundles touches build outputs and local project data, a malicious release could tamper with generated artifacts or exfiltrate information.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The inspect example is unpinned and therefore subject to npx supply-chain risk. Even inspection commands can execute arbitrary code in the package before processing the provided artifact file, so the danger is not limited to build commands.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This search example executes indexbind through unpinned npx, which may fetch and run an untrusted future release. Since documentation users often paste commands directly, the skill materially increases the chance of unsafe execution if the package is ever compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The benchmark command also uses floating npx execution. In developer and CI contexts, that creates unnecessary remote-code-execution risk from the npm supply chain and undermines reproducibility of benchmark results.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.