io.github.geeks-accelerator/inbed

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• scripts/lib/clawhub-account.mjs:47mcp-js-shell-exec-template-literal (critical/medium)

  A shell command is built from a template literal with interpolation. Quoting inside a template does not escape shell metacharacters.

    let handle = null;
    try {
      const out = execSync(`${CLI} whoami --no-input 2>&1`, { encoding: 'utf-8', timeout: 60000 });
      // Interactive output is "✔ handle"; piped output is just "handle".
      const last = out.trim().split('\n').pop() || '';

• scripts/publish-plugin.mjs:45mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

  const TOPICS = 'dating,ai-agents,matchmaking,compatibility,mcp';
  
  const run = (cmd, opts = {}) => execSync(cmd, { cwd: ROOT, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], ...opts });
  const fail = (msg) => { console.error(`\n✖ ${msg}`); process.exit(1); };
  

• scripts/publish-skills.mjs:227mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      if (DRY_RUN) {
        try {
          execSync(publishCommand(slug, displayName, version, { dryRun: true }),
            { encoding: 'utf-8', timeout: 120000, stdio: ['pipe', 'pipe', 'pipe'] });
          // The CLI's --dry-run only packs locally (no server-side checks); ownership

• scripts/publish-skills.mjs:253mcp-js-shell-exec-nonliteral (critical/medium)

  A shell is spawned on a value that is not a string literal. child_process .exec and execSync run their argument through /bin/sh, so any caller-supplied component is shell syntax, not data.

      for (let attempt = 0; attempt < 3 && !handled; attempt++) {
        try {
          const out = execSync(publishCommand(slug, displayName, version),
            { encoding: 'utf-8', timeout: 120000, stdio: ['pipe', 'pipe', 'pipe'] });
          // --json reports publicationStatus: "published", or "pending" when the

• src/app/profiles/[id]/opengraph-image.tsx:58mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    if (rawAvatarUrl) {
      try {
        const avatarRes = await fetch(rawAvatarUrl);
        if (avatarRes.ok) {
          const buf = await avatarRes.arrayBuffer();

• src/lib/docs.ts:17mcp-js-path-join-unvalidated (medium/low)

  A filesystem path is assembled from a non-literal and read or written without confinement. path.join does not resolve away `..`, and path.resolve discards the base entirely on an absolute second component.

   */
  export function readRepoFile(relPath: string): string {
    return fs.readFileSync(path.join(/*turbopackIgnore: true*/ process.cwd(), relPath), 'utf-8');
  }
  

• src/lib/leonardo/generate-avatar.ts:66mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

  
      // 4. Download the generated image
      const imageResponse = await fetch(imageUrl);
      if (!imageResponse.ok) {
        throw new Error(`Failed to download generated image: ${imageResponse.status}`);

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 2 credential-shaped string(s), every one from a keyword or entropy heuristic (Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at README.md:62; Secret Keyword at build/credentials.js:25

• authorization_granularity

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so neither the tool count nor any access-control logic can be read

Maintenance

• recency

  last commit 10 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  this repository publishes neither releases nor version tags

• bus_factor

  3 authors with >= 5 commits in 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  package.json declares 'MIT' but no LICENSE file ships with the source

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately