Clawmem (yoloshii) MCP Server

In the server's implementation (`src/beads.ts:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , execSync } from "node:child_process"; // ============================================================================

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/beads.ts

In the server's implementation (`src/clawmem.ts:1541`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: running inside a judge spawn (CLAWMEM_JUDGE_SPAWN=1)`); writeHookOutput(makeEmptyOutput(hookName)); return; }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/clawmem.ts

In the server's implementation (`src/hermes/__init__.py:73`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: r {})} result = subprocess.run( [bin_path, "hook", hook_name], input=json.dumps(hook_inp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/hermes/__init__.py

In the server's implementation (`src/judge.ts:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nodeSpawn } from "node:child_process"; import { LlamaCpp, type JudgeChatRequest, type JudgeChatResult } from "./llm.ts"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/judge.ts

In the server's implementation (`src/openclaw/index.ts:236`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: erveChild: import("node:child_process").ChildProcess | null = null; api.registerService({ id: "clawmem-api",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw/index.ts

In the server's implementation (`src/openclaw/shell.ts:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess } from "node:child_process"; import { existsSync } from "node:fs"; import { dirname, resolve } from "node:pat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw/shell.ts