Ai Team Os MCP Server

In the server's implementation (`hooks/workflow_reminder.py:479`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ck_patterns = [".env", "id_rsa", ".pem", ".key"] for pat in block_patterns: if pat in cmd_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/workflow_reminder.py

In the server's implementation (`plugin/hooks/workflow_reminder.py:872`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ck_patterns = [".env", "id_rsa", ".pem", ".key"] for pat in block_patterns: if pat in cmd_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugin/hooks/workflow_reminder.py

In the server's implementation (`src/aiteam/hooks/workflow_reminder.py:872`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ck_patterns = [".env", "id_rsa", ".pem", ".key"] for pat in block_patterns: if pat in cmd_

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/aiteam/hooks/workflow_reminder.py

In the server's implementation (`hooks/session_bootstrap.py:117`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: fetch_result = subprocess.run( ["git", "fetch", "--quiet", "origin"], cwd=str

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server hooks/session_bootstrap.py

In the server's implementation (`install.py:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: return subprocess.run( args, cwd=cwd, check=True, shell=(sys.platform == "win

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server install.py

In the server's implementation (`plugin/bootstrap.py:88`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ile=sys.stderr) subprocess.run( [sys.executable, "-m", "venv", str(venv_dir)], capture_o

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugin/bootstrap.py

In the server's implementation (`plugin/hooks/session_bootstrap.py:114`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ain or master).""" subprocess.run( ["git", "fetch", "--quiet", "origin"], cwd=str(project_root),

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugin/hooks/session_bootstrap.py

In the server's implementation (`src/aiteam/hooks/session_bootstrap.py:114`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ain or master).""" subprocess.run( ["git", "fetch", "--quiet", "origin"], cwd=str(project_root),

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/aiteam/hooks/session_bootstrap.py

In the server's implementation (`src/aiteam/mcp/_autostart.py:171`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: out = subprocess.check_output( ["netstat", "-ano", "-p", "TCP"], text=

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/aiteam/mcp/_autostart.py

In the server's implementation (`src/aiteam/mcp/tools/git_ops.py:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: tderr).""" result = subprocess.run( ["git"] + args, capture_output=True, text=True,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/aiteam/mcp/tools/git_ops.py

Untrusted-input tools ([cross_project_inbox, meeting_read_messages]) co-exist with external-action tools ([send_notification, meeting_send_message]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [cross_project_inbox, meeting_read_messages] → sinks [send_notification, meeting_send_message]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow cross_project_inbox → send_notification

In the server's implementation (`plugin/dashboard-dist/assets/index-CICd_ipg.js:11`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t[e.id];try{let r=await import(e.module);return t[e.id]=r,r}catch(r){return console.error(`Error loading route module \`

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugin/dashboard-dist/assets/index-CICd_ipg.js

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_workflow_reminder.py:999`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: lf): """git add id_rsa (SSH key) must call sys.exit(2).""" state: dict = {} event = {"tool_name"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_workflow_reminder.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/integration/test_cross_feature.py:316`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ): """POST with eval() injection → 400.""" client = integration_client resp = client.post(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/integration/test_cross_feature.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_api_comprehensive.py:68`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 在性检查 if not eval(assertion, {"body": body}): # noqa: S307 assertion_failures.append(asserti

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_api_comprehensive.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/install.py:327`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: package") result = subprocess.run( [sys.executable, "-m", "pip", "install", "-e", "."], cwd=str(p

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/install.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/uninstall.py:50`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run( ["powershell", "-NoProfile", "-Command", "(Get-

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/uninstall.py

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/update.py:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: return subprocess.run( args, cwd=cwd, check=True, shell

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/update.py