Execbro MCP Server

In the server's implementation (`build/core/exec.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , execFile } from "node:child_process"; export function execFileAsync(file, args, opts = {}) { const { signal, ...ex

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/core/exec.js

In the server's implementation (`build/core/fingerprint.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import { readFileSync, existsSync, writeFileSync, mkdirSync } from "fs"; import

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/core/fingerprint.js

In the server's implementation (`build/core/ocr.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { getInstallationId } from "./telemetry.js"; const OCR_ENDPOINT = "https:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/core/ocr.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/networkInterceptorXhr.test.js:307`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: lFetch; sandbox.fetch("https://api.example.com/dual"); expect(events().filter((e) => e.type === "request

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/networkInterceptorXhr.test.js

A hardcoded JSON Web Token (an embedded JSON Web Token (often an example or expired token)) appears in `build/__tests__/unit/httpRequest.test.js:6`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server build/__tests__/unit/httpRequest.test.js

A hardcoded JSON Web Token (an embedded JSON Web Token (often an example or expired token)) appears in `build/__tests__/unit/vault.test.js:2`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server build/__tests__/unit/vault.test.js

A hardcoded JSON Web Token (an embedded JSON Web Token (often an example or expired token)) appears in `build/__tests__/unit/vaultSlots.test.js:3`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server build/__tests__/unit/vaultSlots.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/helpers/mock-harness.js:61`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: teContext(sandbox); vm.runInContext(getInterceptorScript(), sandbox); vm.runInContext(buildMockPushScript(JSON.s

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/helpers/mock-harness.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/appContext.test.js:6`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) { const run = new Function("globalThis", source + "; return (" + expr + ");"); return run(globalStub);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/appContext.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/appRequest.test.js:40`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ); expect(() => new Function("return " + src.replace(/^\(function/, "(function"))).not.toThrow(); }); it

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/appRequest.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/inputTarget.test.js:158`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }; return eval(expr); }; it("still reports the wrapper as the field's name", () => { const

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/inputTarget.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/measureComponentResolution.test.js:53`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: dex); return (await new Function(`return (${expr});`)()); } afterEach(() => { const g = globalThis; delete g

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/measureComponentResolution.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/moduleRegistry.test.js:27`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: }; const run = new Function("globalThis", source + "; return __eb_require;"); const req = run(globalThi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/moduleRegistry.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/navigation.test.js:6`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ) { const run = new Function("globalThis", source + "; return __eb_nav;"); return run(globalStub); }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/navigation.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/networkInterceptorXhr.test.js:59`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: teContext(sandbox); vm.runInContext(getInterceptorScript(), sandbox); return { sandbox: sandbox,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/networkInterceptorXhr.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/pressablesLongPress.test.js:44`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: d) { const fn = new Function("globalThis", `return (${expression.trim()});`); last = fn(globalThisStub);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/pressablesLongPress.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/pressablesSwitch.test.js:44`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: d) { const fn = new Function("globalThis", `return (${expression.trim()});`); last = fn(globalThisStub);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/pressablesSwitch.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/componentFormatNaming.test.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from "node:child_process"; describe("component formatter naming", () => { it("no production source, doc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/componentFormatNaming.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/fingerprint.test.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ss = await import("node:child_process"); const realFs = await import("node:fs"); const realOs = await import("node:os");

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/fingerprint.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`build/__tests__/unit/keyboardMetrics.test.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eyboardState(undefined, exec({ visible: true, metrics: { height: 345, screenY: 567, width: 420 } })); expect(s).

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server build/__tests__/unit/keyboardMetrics.test.js