Gemini (chrischall) MCP Server

Tools that read sensitive data ([gemini_list_files]) and tools that can send data out ([gemini_upload_file]) are exposed together. An agent can move private data to the sink.

Evidence: sources [gemini_list_files] → sinks [gemini_upload_file]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow gemini_list_files → gemini_upload_file

In the server's implementation (`dist/bundle.js:26379`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); const v

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bundle.js

In the server's implementation (`dist/bundle.js:33114`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import { promisify } from "node:util"; import { readFile as readFile2, unlink }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bundle.js

In the server's implementation (`dist/clipboard.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from 'node:child_process'; import { promisify } from 'node:util'; import { readFile, unlink } from 'node:fs

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/clipboard.js

In the server's implementation (`dist/tools/shared.js:635`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: the macOS clipboard via child_process)'); if (args.video_path) unavailable.push('`video_path` (uploads a fil

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/shared.js

Tool "gemini_delete_file" can write, overwrite or delete files (keyword "delete_file" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool gemini_delete_file

Tool "gemini_delete_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool gemini_delete_file

Tool "gemini_delete_file" takes a path parameter "file_uri" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.

Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.

Location: tool gemini_delete_file · inputSchema.properties.file_uri