Cicy Desktop MCP Server

In the server's implementation (`src/sidecar/colima-docker.js:560`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .ssh; { [ -f $HOME/.ssh/id_ed25519 ] || [ -f $HOME/.ssh/id_rsa ]; } || ssh-keygen -t ed25519 -N "" -f $HOME/.ssh/id_ed25

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/sidecar/colima-docker.js

In the server's implementation (`src/backends/homepage-react/assets/index-OG6JB73F.js:399`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: le;if(L.js)return await new Function(`return (async()=>{${L.js}})()`)();if(!L.tool)return{error:"no tool"};const W=await

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/backends/homepage-react/assets/index-OG6JB73F.js

In the server's implementation (`workers/render/src/App.jsx:1446`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nc return await new Function(`return (async()=>{${f.js}})()`)(); } if (!f.tool) return { error: "no

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server workers/render/src/App.jsx

In the server's implementation (`src/app-updater.js:402`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require("child_process"); const exe = process.execPath; const dir = path.join(process.env.LOCALAPPDAT

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/app-updater.js

In the server's implementation (`src/backends/ipc.js:118`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } = require("child_process"); const port = 8008; // Kill by PID from lsof (works on same-user pr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/backends/ipc.js

In the server's implementation (`src/backends/local-teams.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } = require("child_process"); const { spawn } = require("child_process"); const { BrowserWindow, nativeImage

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/backends/local-teams.js

In the server's implementation (`src/backends/open-external.js:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: st { spawn } = require("child_process"); const log = require("electron-log"); function trySpawn(cmd, args) { try {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/backends/open-external.js

In the server's implementation (`src/backends/sidecar-ipc.js:200`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { require("child_process").execFile("shutdown", ["/r", "/t", String(delaySec), "/c", why || "CiCy Desktop:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/backends/sidecar-ipc.js

In the server's implementation (`src/backends/window-manager.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } = require("child_process"); const { promisify } = require("util"); const execFileAsync = promisify(execFile

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/backends/window-manager.js

In the server's implementation (`src/chrome/chrome-launcher.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } = require("child_process"); const { isPortOpen } = require("../utils/process-utils"); const { waitForDebugg

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/chrome/chrome-launcher.js

In the server's implementation (`src/backends/homepage-react/assets/index-OG6JB73F.js:405`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ise(function(res){var q=https.request("https://ws.cicy-ai.com/api/enroll",{method:"POST",headers:{Authorization:"Bearer

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/backends/homepage-react/assets/index-OG6JB73F.js

In the server's implementation (`workers/render/src/App.jsx:1696`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ise(function(res){var q=https.request("https://ws.cicy-ai.com/api/enroll",{method:"POST",headers:{Authorization:"Bearer

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server workers/render/src/App.jsx

In the server's implementation (`workers/render/worker.js:215`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const r = await fetch("https://ws.cicy-ai.com/api/instances", { headers: { authorization: "Bearer " + tok } });

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server workers/render/worker.js

In the server's implementation (`src/main-old.js:644`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "python-exec.py"); exec(`python3 ${pythonPath} '${code.replace(/'/g, "'\\''")}'`, (error, stdout, stderr) => {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/main-old.js

In the server's implementation (`src/main.js:2159`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { execSync(`taskkill /F /IM ${t}.exe`, { stdio: "ignore", windowsHide: true }); } catch {}

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/main.js

In the server's implementation (`src/tools/system-tools.js:48`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: processName = execSync(`ps -p ${pid} -o comm=`, { encoding: "utf8" }).trim(); } catch (e) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/tools/system-tools.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/r2.mjs:70`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: (); const res = await fetch(`https://api.cloudflare.com/client/v4/accounts/${ACCOUNT}${path}`, { headers: { Author

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/r2.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`test/homepage-remote.test.js:46`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rts: {} }; const fn = new Function( "require", "path", "module", "__dirname", body + "\nmodule.exp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test/homepage-remote.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`test/telegram-identity.test.js:22`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ); assert.equal(await vm.runInContext(TELEGRAM_IDENTITY_SCRIPT, ctx), null); }); test("identity script never leaks au

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test/telegram-identity.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/build-homepage.cjs:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require("child_process"); const fs = require("fs"); const path = require("path"); const ROOT = path.join

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/build-homepage.cjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/r2.mjs:25`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { pathToFileURL } from "node:url"; import { existsSync, statSync } from "

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/r2.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/sync-runtime-deps.cjs:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require("child_process"); const fs = require("fs"); const path = require("path"); const REGISTRY = proce

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/sync-runtime-deps.cjs

In a packaging/dev/install script (shipped, but not the server runtime) (`test/chrome-launcher.test.js:57`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: romeAppToForeground } = require(launcherPath); childProcess.spawn = originalSpawn; bringChromeAppToForeground("/App

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test/chrome-launcher.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`test/desktop-snapshot-tools.test.js:48`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }); let handler; require(toolsPath)((name, _description, _schema, registeredHandler) => { if (name === "deskt

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test/desktop-snapshot-tools.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`test/electron-inject-tools.test.js:16`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Path]; let handler; require(modulePath)((name, _description, _schema, candidate) => { if (name === "electron_inj

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server test/electron-inject-tools.test.js