Is Packmind MCP server safe?
- Python shell/command execution
- Node.js shell/command execution
- Possible command injection (exec with dynamic command)
packmind is an AI npm_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 13 risky constructs are reported for review. It can: dynamic code execution, filesystem read, filesystem write, install time execution, mcp tools detected, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 30/100 (medium).
packmind 1.18.1
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Packmind MCP server's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (13)
The code builds an OS command out of values that can change at runtime, then runs it through a shell.
const stdout = execSync(`git ${cmd}`, {execSync(`npm install -g ${NPM_PACKAGE}@${version}`, {Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.
Fix: Use execFile/spawn with an argument array instead of exec; never build a shell command string from external input.
The code turns strings into live code at runtime (eval / new Function / exec).
const func = new Function(
Why it matters: If those strings aren't fixed and trusted, they become a way to run arbitrary code.
Fix: Avoid evaluating dynamically constructed code; if unavoidable, ensure the input is a trusted constant and never derived from external data.
An MCP server entry launches a command on your host.
"command": "npx",
"command": "npx",
Why it matters: Trusting the manifest means running that binary — verify what it is and where it comes from.
Fix: Verify the launched command and its source before trusting this MCP server configuration.
The component can run operating-system commands or spawn processes.
const embedResult = await Bun.spawn(['bun', 'run', embedWasmScript], {const compileResult = await Bun.spawn(
import { execSync, ExecSyncOptions } from 'child_process';const stdout = execSync(`git ${cmd}`, {const result = execSync('git rev-parse --show-toplevel', {import { execSync } from 'child_process';execSync(`npm install -g ${NPM_PACKAGE}@${version}`, {import { spawnSync } from 'child_process';const result = spawnSync(editor, [tmpFile], {import { spawnSync } from 'node:child_process';const res = spawnSync(command, {import { execFileSync, spawnSync } from 'node:child_process';const claudeCheck = spawnSync('claude', ['--version'], { stdio: 'ignore' });import { spawnSync } from 'node:child_process';res = spawnSync('script', ['-q', tsFile, '/bin/sh', '-c', joined], {res = spawnSync('script', ['-qec', joined, tsFile], {const rsvg = spawnSync('rsvg-convert', ['-z', '2', svgPath, '-o', pngPath], {const ql = spawnSync(
import { execSync } from 'node:child_process';execSync('pnpm husky', { stdio: 'inherit' });execSync('pnpm chakra:typegen', { stdio: 'inherit' });Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.
The component can run operating-system commands or spawn processes.
result = subprocess.run(
["git", "-C", cwd, "symbolic-ref", "--short", "HEAD"],
capture_output=True, text=True, timeout=2
)Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.
A server is bound to all network interfaces (0.0.0.0), not just your own machine.
host: process.env.NX_WATCHER ? '0.0.0.0' : 'localhost',
Why it matters: Without authentication, other hosts on the network can reach it.
Fix: Bind to 127.0.0.1 for local-only use, or require authentication and restrict access if remote exposure is intended.
The component reads files from disk.
const packageJsonContent = fs.readFileSync(packageJsonPath, 'utf-8');
let content = fs.readFileSync(mainCjsPath, 'utf8');
const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
const mainContent = fs.readFileSync(mainCjsPath, 'utf8');
return await fs.readFile(filePath, 'utf-8');
content = await fs.readFile(filePath, 'utf-8');
const existingContent = await fs.readFile(fullPath, 'utf-8');
const existingContent = await fs.readFile(fullPath, 'utf-8');
currentContent = await fs.readFile(fullPath, 'utf-8');
const existingContent = await fs.readFile(fullPath, 'utf-8');
currentContent = await fs.readFile(fullPath, 'utf-8');
const actual = await fs.readFile(fullPath);
const actual = await fs.readFile(fullPath, 'utf-8');
localContent = await fs.readFile(fullPath, 'utf-8');
return await fs.readFile(filePath, 'utf-8');
const buffer = await fs.readFile(filePath);
localContent = await fs.readFile(fullPath, 'utf-8');
const content = fs.readFileSync(lockFilePath, 'utf-8');
cas.push(fs.readFileSync(certFile));
const configContent = await fs.readFile(configPath, 'utf-8');
return await fs.readFile(filePath, 'utf-8');
const content = await fs.readFile(lockFilePath, 'utf-8');
const content = fs.readFileSync(this.storagePath, 'utf-8');
const content = fs.readFileSync(credentialsPath, 'utf-8');
const content = fs.readFileSync(credentialsPath, 'utf-8');
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
fs.writeFileSync(mainCjsPath, content);
fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
fs.writeFileSync(mainCjsPath, '#!/usr/bin/env node\n' + mainContent);
fs.writeFileSync(path.join(moduleDir, 'index.js'), stubContent.trim());
fs.writeFileSync(
await fs.writeFile(fullPath, file.content, 'utf-8');
await fs.writeFile(fullPath, file.content, 'utf-8');
await fs.writeFile(fullPath, buffer);
await fs.writeFile(fullPath, finalContent, 'utf-8');
await fs.writeFile(fullPath, content, 'utf-8');
await fs.unlink(fullPath);
await fs.writeFile(fullPath, mergedContent, 'utf-8');
await fs.rm(fullPath, { recursive: true, force: true });await fs.unlink(fullPath);
await fs.rm(fullPath, { recursive: true, force: true });await fs.writeFile(fullPath, buffer);
await fs.writeFile(fullPath, finalContent, 'utf-8');
await fs.writeFile(fullPath, content, 'utf-8');
await fs.unlink(fullPath);
await fs.writeFile(fullPath, mergedContent, 'utf-8');
await fs.rm(fullPath, { recursive: true, force: true });await fs.unlink(fullPath);
await fs.rm(fullPath, { recursive: true, force: true });deleteFile: deps?.deleteFile ?? ((path) => fs.unlinkSync(path)),
await fs.rm(path.join(baseDirectory, dir), {Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component reads files from disk.
result = parse(path.read_text(encoding="utf-8"))
text = path.read_text(encoding="utf-8")
for match in TASK_STATE.finditer(plan_path.read_text(encoding="utf-8")):
content = path.read_text(encoding="utf-8")
result = parse(path.read_text(encoding="utf-8"))
text = path.read_text(encoding="utf-8")
for match in TASK_STATE.finditer(plan_path.read_text(encoding="utf-8")):
content = path.read_text(encoding="utf-8")
result = parse(path.read_text(encoding="utf-8"))
text = path.read_text(encoding="utf-8")
for match in TASK_STATE.finditer(plan_path.read_text(encoding="utf-8")):
content = path.read_text(encoding="utf-8")
result = parse(path.read_text(encoding="utf-8"))
text = path.read_text(encoding="utf-8")
for match in TASK_STATE.finditer(plan_path.read_text(encoding="utf-8")):
content = path.read_text(encoding="utf-8")
result = parse(path.read_text(encoding="utf-8"))
text = path.read_text(encoding="utf-8")
for match in TASK_STATE.finditer(plan_path.read_text(encoding="utf-8")):
content = path.read_text(encoding="utf-8")
content = skill_md.read_text()
result = parse(path.read_text(encoding="utf-8"))
text = path.read_text(encoding="utf-8")
for match in TASK_STATE.finditer(plan_path.read_text(encoding="utf-8")):
content = path.read_text(encoding="utf-8")
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
path.write_text(content, encoding="utf-8")
path.write_text(content, encoding="utf-8")
path.write_text(content, encoding="utf-8")
path.write_text(content, encoding="utf-8")
path.write_text(content, encoding="utf-8")
skill_md_path.write_text(skill_content)
example_script.write_text(EXAMPLE_SCRIPT.format(skill_name=skill_name))
example_reference.write_text(EXAMPLE_REFERENCE.format(skill_title=skill_title))
example_asset.write_text(EXAMPLE_ASSET)
path.write_text(content, encoding="utf-8")
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
package.json has a 'prepare' script (runs on git/local installs and before publishing).
"prepare": "node scripts/prepare.mjs",
Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.
Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.
The component makes outbound network requests.
import axios from 'axios';
const response = await axios.post<typeof conversionData>(
if (axios.isAxiosError(error)) {import axios from 'axios';
await axios.post(WEBHOOK_URL, payload, {nodemailer: STUB_MODULE,
'nodemailer',
'@types/nodemailer',
// ioredis, typeorm, nodemailer, @nestjs/common
'nodemailer',
'@types/nodemailer',
'nodemailer',
'@types/nodemailer',
const response = await fetch(url, {const response = await fetch(url, {// @ts-expect-error — Node.js fetch (undici) accepts a dispatcher option not present in the DOM types
const response = await fetch(`${host}/api/v0/auth/me`, {// @ts-expect-error — Node.js fetch (undici) accepts a dispatcher option not present in the DOM types
const response = await fetch(
* round-trip but not for a multi-megabyte body: on a slow uplink axios aborts a
const response = await fetch(
await fetch("/api/invoices", { method: "POST", body: JSON.stringify(invoice) })import axios from "axios" // ❌ domain depends on infrastructure
await axios.post("/users", this)import axios, { AxiosInstance, AxiosRequestConfig } from 'axios';Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An MCP tool surface (manifest or tool definitions) was found.
"mcpServers": {Why it matters: Just context — review which tools it offers and their permissions.
Fix: Review the declared MCP tools and their permissions.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →