Adelaidasofia Instagram MCP Server

In the server's implementation (`instagram_mcp/auth.py:78`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: cret: str) -> None: subprocess.run( ["security", "add-generic-password", "-U", "-a", account, "-s", KEYCHAIN

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server instagram_mcp/auth.py

Untrusted-input tools ([get_messages]) co-exist with external-action tools ([send_message]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [get_messages] → sinks [send_message]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow get_messages → send_message

Tool "remove_account" describes a credential store (SSH keys, cloud credentials, a keychain or an equivalent) that nothing in its input schema can address. A tool's interface is the honest statement of what it touches; prose that reaches past it is addressed to the model, not to a reader.

Evidence: keychain

Fix: Remove the reference, or expose the target as an explicit, validated parameter so the client can see and consent to what the tool reads.

Location: tool remove_account · description