Agent Security Scanner MCP Server

Tools that read sensitive data ([readFi1e]) and tools that can send data out ([scan_agent_action]) are exposed together. An agent can move private data to the sink.

Evidence: sources [readFi1e] → sinks [scan_agent_action]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow readFi1e → scan_agent_action

In the server's implementation (`src/tools/scan-skill.js:404`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: th('.env') && entry !== '.npmrc' && entry !== '.github') continue; const filePath = join(dir, entry); let lst;

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/tools/scan-skill.js

Instruction-override directive detected in the description of tool "readFi1e". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.

Evidence: Ignore previous instructions

Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.

Location: tool readFi1e · description

In the server's implementation (`code-review-agent/dist/src/analyzer/intent.js:12`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: commerce app that calls eval() on user input is UNEXPECTED — a product catalog has no reason to eval Focus on: 1. What

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/dist/src/analyzer/intent.js

In the server's implementation (`code-review-agent/dist/src/analyzer/semantic.js:10`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: commerce app that calls eval() on user input IS a vulnerability — a product catalog has no reason to eval Ask yourself:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/dist/src/analyzer/semantic.js

In the server's implementation (`code-review-agent/src/analyzer/intent.ts:15`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: commerce app that calls eval() on user input is UNEXPECTED — a product catalog has no reason to eval Focus on: 1. What

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/src/analyzer/intent.ts

In the server's implementation (`code-review-agent/src/analyzer/semantic.ts:22`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: commerce app that calls eval() on user input IS a vulnerability — a product catalog has no reason to eval Ask yourself:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/src/analyzer/semantic.ts

In the server's implementation (`code-review-agent/dist/src/analyzer/intent.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: A build tool that calls subprocess.run() with hardcoded commands is EXPECTED behavior — that's its purpose - An auth API

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/dist/src/analyzer/intent.js

In the server's implementation (`code-review-agent/dist/src/analyzer/semantic.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: A build tool that calls subprocess.run() with hardcoded commands is NOT a vulnerability — that's its purpose - An e-comm

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/dist/src/analyzer/semantic.js

In the server's implementation (`code-review-agent/dist/src/llm/claude-cli.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { SchemaValidationError } from './provider.js'; import { zodToJsonSchema

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/dist/src/llm/claude-cli.js

In the server's implementation (`code-review-agent/src/analyzer/intent.ts:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: A build tool that calls subprocess.run() with hardcoded commands is EXPECTED behavior — that's its purpose - An auth API

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/src/analyzer/intent.ts

In the server's implementation (`code-review-agent/src/analyzer/semantic.ts:21`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: A build tool that calls subprocess.run() with hardcoded commands is NOT a vulnerability — that's its purpose - An e-comm

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/src/analyzer/semantic.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/javascript_injection.js:9`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: // VULN: eval-detected eval(userInput); // VULN: function-constructor var fn = new Function(userInput); // VULN: setT

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/javascript_injection.js

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/python_injection.py:46`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eval-detected result = eval(user_code) # VULN: exec-detected exec(user_code) # VULN: compile-detected code = compile(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/python_injection.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/python_taint.py:238`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nt: {}".format(msg) eval(log_entry) # SAFE: python.lang.security.format-string-injection import logging

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/python_taint.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/typescript_security.ts:22`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ection const result = eval(expr); // VULN: typescript.lang.security.eval-injection const fn = new Function("retur

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/typescript_security.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`code-review-agent/tests/analyzer/semantic.test.ts:28`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , content: 'const x = eval(req.query.code);', language: 'javascript', lineCount: 1, imports: ['express'], impo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/tests/analyzer/semantic.test.ts

In a packaging/dev/install script (shipped, but not the server runtime) (`code-review-agent/tests/fixtures/vuln-api-server/server.js:25`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tion const filterFn = eval(`(user) => ${filter}`); db.all('SELECT * FROM users', (err, users) => { if (err) retu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server code-review-agent/tests/fixtures/vuln-api-server/server.js

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/benchmark_runner.py:104`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: commit = subprocess.check_output( ['git', 'rev-parse', '--short', 'HEAD'], stderr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/benchmark_runner.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/javascript_injection.js:25`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: mand injection --- var child_process = require("child_process"); var filename = "user_provided.txt"; // VULN: child-pr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/javascript_injection.js

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/python_injection.py:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: angerous-subprocess-use subprocess.call(user_input, shell=True) # VULN: dangerous-subprocess-use subprocess.Popen(user_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/python_injection.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/python_taint.py:64`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y.command-injection os.system("ping -c 1 " + host) # VULN: python.lang.security.command-injection subproces

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/python_taint.py

In a packaging/dev/install script (shipped, but not the server runtime) (`benchmarks/corpus/typescript_security.ts:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: execSync, exec } from "child_process"; import express, { Request, Response } from "express"; const app = express(); /

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server benchmarks/corpus/typescript_security.ts

"agent-security-scanner-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/postinstall.js

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package agent-security-scanner-mcp