mindbox@1.0.3

CAUTION

Publisher claims: "Generate and revise editable offline mindmap HTML from notes, documents, ideas or saved Mindbox HTML. Use for 思维导图, style recommendations, same-topic edits or requests such as “换成脑洞涂鸦”. Not for precise workflows or cross-node relationship diagrams." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher markingyang · joined 2 days agoInstalls 55Last detonated 23 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

File type combined with upload actionreferences/maintenance.md:9 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagescripts/manage.cjs:54 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/maintenance.md:44 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionscripts/render.cjs:64 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagereferences/maintenance.md:43 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionTHIRD_PARTY_NOTICES.md:17 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packageTHIRD_PARTY_NOTICES.md:20 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/maintenance.md:48 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionscripts/render.cjs:39 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packageassets/runtime/src/index.html:29 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/maintenance.md:42 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageassets/runtime/src/index.html:26 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/maintenance.md:41 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageassets/runtime/src/index.html:10 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionscripts/render.cjs:41 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packageassets/runtime/src/index.html:30 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageassets/runtime/src/index.html:28 · npx invocation of non-well-known package — may execute untrusted code

AST06