Claude Flow — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "claude-flow",
"source": {
"kind": "package",
"origin": "claude-flow"
},
"server": {
"name": "claude-flow"
}
},
"grade": "A",
"score": {
"score": 93,
"threatScore": 100,
"grade": "A",
"band": "A",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "high",
"label": "capability blast radius (high) — client exposure if the model is manipulated",
"appliedPenalty": 6
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "high",
"reasons": [
"can send data / act on an external service",
"can execute shell commands or code"
],
"tags": [
"code-exec",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": false,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (v3/@claude-flow/cli/dist/src/commands/analyze.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/analyze.js:297`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/analyze.js"
},
"evidence": "securityIssues.push('new Function()'); fileStats.push({ file: filePath,",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "v3/@claude-flow/cli/dist/src/commands/analyze.js",
"line": 297,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (v3/@claude-flow/cli/dist/src/commands/neural.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/neural.js:1445`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/neural.js"
},
"evidence": "'eval(', 'Function(', 'exec(', 'spawn(', 'child_process', 'rm -rf', 'sudo',",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "v3/@claude-flow/cli/dist/src/commands/neural.js",
"line": 1445,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (.claude/helpers/github-safe.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`.claude/helpers/github-safe.js:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": ".claude/helpers/github-safe.js"
},
"evidence": "c, execFileSync } from 'child_process'; import { writeFileSync, unlinkSync } from 'fs'; import { tmpdir } from 'os'; imp",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": ".claude/helpers/github-safe.js",
"line": 22,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (.claude/helpers/hook-handler.cjs)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`.claude/helpers/hook-handler.cjs:82`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": ".claude/helpers/hook-handler.cjs"
},
"evidence": "st { spawn } = require('child_process'); const cliBin = resolveCliBinForHook(); const cmd = process.platform ===",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": ".claude/helpers/hook-handler.cjs",
"line": 82,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (.claude/helpers/statusline.cjs)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`.claude/helpers/statusline.cjs:25`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": ".claude/helpers/statusline.cjs"
},
"evidence": "{ execSync } = require('child_process'); const os = require('os'); // Configuration const CONFIG = { maxAgents:",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": ".claude/helpers/statusline.cjs",
"line": 25,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js"
},
"evidence": "{ execSync } from 'node:child_process'; import { RvfaWriter, } from './rvfa-format.js'; // ── Encryption Constants ─────",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "v3/@claude-flow/cli/dist/src/appliance/rvfa-builder.js",
"line": 10,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js"
},
"evidence": "rt { spawn } from 'node:child_process'; import { tmpdir } from 'node:os'; import { RvfaReader } from './rvfa-format.js';",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "v3/@claude-flow/cli/dist/src/appliance/rvfa-runner.js",
"line": 11,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (v3/@claude-flow/cli/dist/src/commands/doctor.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/doctor.js:1666`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/doctor.js"
},
"evidence": "const resp = await fetch(`http://${bind}/status`, { headers: { authorization: `Bearer ${token}` },",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "v3/@claude-flow/cli/dist/src/commands/doctor.js",
"line": 1666,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (v3/@claude-flow/cli/dist/src/commands/neural.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/neural.js:1153`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/neural.js"
},
"evidence": "const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', { method: 'POST',",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "v3/@claude-flow/cli/dist/src/commands/neural.js",
"line": 1153,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js:166`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js"
},
"evidence": "const res = await fetch('https://api.anthropic.com/v1/messages', { method: 'POST', headers",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "v3/@claude-flow/cli/dist/src/mcp-tools/agent-execute-core.js",
"line": 166,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (v3/@claude-flow/cli/dist/src/update/checker.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/update/checker.js:35`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/update/checker.js"
},
"evidence": "const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, { headers: {",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "v3/@claude-flow/cli/dist/src/update/checker.js",
"line": 35,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (.claude/helpers/hook-handler.cjs)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`.claude/helpers/hook-handler.cjs:222`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": ".claude/helpers/hook-handler.cjs"
},
"evidence": "y { const mod = require(modulePath); return mod; } finally { console.log = origLog;",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": ".claude/helpers/hook-handler.cjs",
"line": 222,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js:249`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js"
},
"evidence": "return await import(pkg); } catch { return null; } } /** Tier-1 A",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/appliance/ruvllm-bridge.js",
"line": 249,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (v3/@claude-flow/cli/dist/src/commands/agntcy/publish.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/agntcy/publish.js:101`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/agntcy/publish.js"
},
"evidence": "const mod = (await import(AGNTCY_PACKAGE_NAME)); if (typeof mod.publishAgentRecord !== 'function') {",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/commands/agntcy/publish.js",
"line": 101,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js:93`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js"
},
"evidence": "0 forbid. await import(packageName); return { configured: true, reason: `${packageName} resolved`, endpo",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/commands/agntcy/runtime.js",
"line": 93,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (v3/@claude-flow/cli/dist/src/commands/appliance.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/appliance.js:27`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/appliance.js"
},
"evidence": "const mod = await import(path); return mod[exportName]; } catch { output.printError(`RVFA",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/commands/appliance.js",
"line": 27,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (v3/@claude-flow/cli/dist/src/commands/doctor.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/doctor.js:1167`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/doctor.js"
},
"evidence": "const mod = await import(specifier); if (!mod.FederationNodeState) { return {",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/commands/doctor.js",
"line": 1167,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (v3/@claude-flow/cli/dist/src/commands/init.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/init.js:52`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/init.js"
},
"evidence": "async () => (await import(codexModuleId)).CodexInitializer, // Strategy 2: Project node_modules (works if i",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/commands/init.js",
"line": 52,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (v3/@claude-flow/cli/dist/src/commands/memory-distill.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`v3/@claude-flow/cli/dist/src/commands/memory-distill.js:230`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/commands/memory-distill.js"
},
"evidence": "Database = (await import(mod)).default; } catch { output.writeln(output.warning('bette",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/commands/memory-distill.js",
"line": 230,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (.claude-plugin/scripts/ruflo-hook.cjs)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`.claude-plugin/scripts/ruflo-hook.cjs:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": ".claude-plugin/scripts/ruflo-hook.cjs"
},
"evidence": ", execSync } = require('child_process'); const fs = require('fs'); const path = require('path'); /** Exit 0 uncondition",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": ".claude-plugin/scripts/ruflo-hook.cjs",
"line": 27,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js:44`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js"
},
"evidence": "{ execSync } from 'node:child_process'; import * as fs from 'node:fs'; import * as path from 'node:path'; import { SMOKE",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-agent.js",
"line": 44,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js:35`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js"
},
"evidence": "{ execSync } from 'node:child_process'; import { runGaiaAgent, } from './gaia-agent.js'; // ----------------------------",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-critic.js",
"line": 35,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js:36`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js"
},
"evidence": "{ execSync } from 'node:child_process'; // --------------------------------------------------------------------------- /",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-decomposer.js",
"line": 36,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in packaging/dev tooling (v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js:30`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js"
},
"evidence": "{ execSync } from 'node:child_process'; // --------------------------------------------------------------------------- /",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-judge.js",
"line": 30,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal in packaging/dev tooling (v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.js:237`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.js"
},
"evidence": "ed weights. */ import(state) { if (!Array.isArray(state.weights) || state.weights.length !=",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.js",
"line": 237,
"nonRuntime": true
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal in packaging/dev tooling (v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.smoke.js)",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "In a packaging/dev/install script (shipped, but not the server runtime) (`v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.smoke.js:185`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.smoke.js"
},
"evidence": "ictor(); predictor2.import(exported); assert.equal(predictor2.isTrained, true, 'imported predictor should be tra",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "v3/@claude-flow/cli/dist/src/benchmarks/gaia-hardness/predictor.smoke.js",
"line": 185,
"nonRuntime": true
}
}
],
"toxicFlows": [],
"capabilities": [],
"surfaceDigest": "17ee66287317d1c79c9de01ae25da5f11550fe3aa83f1ab9f239d1137187aad4",
"stats": {
"tools": 0,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 7,
"medium": 12,
"low": 7,
"info": 0
}
}
}