Prompts (hasna) MCP Server

In the server's implementation (`dist/server/index.js:4636`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); const val

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server/index.js

In the server's implementation (`dist/cli/index.js:757`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ildProcess = __require("child_process"); var path = __require("path"); var fs = __require("fs"); var process2 = __

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/index.js

In the server's implementation (`dist/cli/index.js:6809`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { return await import(specifier); } catch (e) { const msg = e instanceof Error ? e.message : String(e);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/index.js

In the server's implementation (`dist/index.js:2224`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { return await import(specifier); } catch (e) { const msg = e instanceof Error ? e.message : String(e);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/mcp/index.js:3210`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { return await import(specifier); } catch (e) { const msg = e instanceof Error ? e.message : String(e);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/mcp/index.js

In the server's implementation (`dist/server/index.js:9829`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try { return await import(specifier); } catch (e) { const msg = e instanceof Error ? e.message : String(e);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server/index.js

"@hasna/prompts" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node postinstall.mjs

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package @hasna/prompts