Security audit
Security checks for vulnerabilities and agentic risk
Mindbox’s local mindmap generation and optional maintenance actions are disclosed, purpose-aligned, and controlled by the user.
Generated HTML and companion Markdown contain your content; saved HTML can also retain notes and unfinished drafts, so review files before sharing. For installation or updates, prefer reviewed installer and source versions; global commands affect Mindbox across selected assistants.
Without declared permissions the skill's intent is opaque and cannot be validated.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The installation command invokes an unpinned npm CLI through npx skills, not an MCP server. If fetched, a compromised or unexpectedly changed package could execute with the agent's permissions and modify global skill installations; limiting installation to explicit user requests reduces exposure but does not ensure package integrity.
Although listing installations is intended to be read-only, npx skills list -g can fetch and execute an unpinned npm package. A compromised CLI would not be constrained by the read-only meaning of list and could access files or alter the host under the agent's permissions.
The update command uses an unpinned npm CLI whose fetched implementation can change independently of this documentation. The explicit mindbox filter and user-request requirement appropriately constrain intended behavior, but a compromised CLI could ignore those constraints and modify other files or installations.
The removal command can execute an unpinned npm CLI with access to global assistant installation directories. Confirmation and the explicit removal filter reduce accidental deletion by the legitimate CLI, but they do not protect against malicious code in a compromised fetched version.
The release-switching command pins the skill source to a version tag but still invokes the installer through unversioned npx skills. Pinning the installed skill does not secure the installer itself, so a compromised fetched CLI could execute arbitrary code before or during installation.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
async function checkLatest(directory,fetcher=fetch){
const installed=inspect(directory);
try{
const response=await fetcher('https://api.github.com/repos/MarkingYang/mindbox/releases/latest',{headers:{Accept:'application/vnd.github+json','User-Agent':'mindbox-version-check'},signal:AbortSignal.timeout(5000)});
if(response.status===404)return {installed:installed.version,status:'unpublished',message:'No published stable GitHub release was found.'};
if(!response.ok)throw new Error('GitHub HTTP '+response.status);
const release=await response.json(),version=String(release.tag_name||'').replace(/^v/,'');
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
checkLatest sends an HTTPS request to GitHub to discover newer skill releases, and line L56 exposes this behavior through --check. Release discovery is unrelated to generating or revising offline mindmap HTML and is not included in the stated scope. The request is explicitly invoked and does not send document content, which limits the risk.
No suspicious patterns detected.