Whiteboard (kamiazya) MCP Server

In the server's implementation (`dist/web-app/assets/chunk-EIO257PC-Dt-y2JKs.js:2`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: pt(e,t){return e=ft(e),Function(`body`,`return function ${e}() { "use strict"; return body.apply(this, arguments

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web-app/assets/chunk-EIO257PC-Dt-y2JKs.js

In the server's implementation (`dist/daemon/ensure-daemon.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from 'node:child_process'; import { mkdirSync, openSync } from 'node:fs'; import { join } from 'node:path';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/daemon/ensure-daemon.js

In the server's implementation (`dist/cli/daemon-ping-client.js:26`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${connectHost}:${port}/api/runtime/ping`, { signal: AbortSignal.timeou

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/daemon-ping-client.js

In the server's implementation (`dist/cli/server-doctor.js:98`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${connectHost}:${port}/api/runtime/status`, { signal: AbortSignal.time

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/server-doctor.js

In the server's implementation (`dist/daemon/ensure-daemon.js:87`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${host}:${port}/api/runtime/ping`); return res.ok; } catch {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/daemon/ensure-daemon.js

In the server's implementation (`dist/server/mcp/tools/canvas-inspect.js:26`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: oDoc(); doc.import(bytes); return summarizeCanvas(doc); }, }; } //# sourceMappingURL

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server/mcp/tools/canvas-inspect.js

In the server's implementation (`dist/server/routes/canvas/live-doc.js:43`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: eId, slug); doc.import(bytes); try { await saveCanvas(workspaceId, slug, doc, { overwrite: t

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server/routes/canvas/live-doc.js

In the server's implementation (`dist/web-app/assets/app-routes-C6xmFr8d.js:971`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: let r = await n(()=>import(e.module).then(async (m)=>{ await m.__tla; return

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web-app/assets/app-routes-C6xmFr8d.js

In the server's implementation (`dist/web-app/assets/import-browser-local-DJP4aKTB.js:21`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: return new u().import(e), !0; } catch { return !1; } } let h; m = clas

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web-app/assets/import-browser-local-DJP4aKTB.js

In the server's implementation (`dist/web-app/assets/loro_wasm_bg-DU7zxaV1.js:1299`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } } import(e) { try { let r = i.__wbindgen_add_to_stack_pointer(-16), a

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/web-app/assets/loro_wasm_bg-DU7zxaV1.js

A hardcoded Google API key (a public Firebase/web API key) appears in `dist/web-app/assets/chunk-ZUYEQ4TG-BzFOpW--.js:1`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: Google API key: AIza…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server dist/web-app/assets/chunk-ZUYEQ4TG-BzFOpW--.js