Kbot — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.13.0",
"methodologyVersion": "mcptrustchecker-1.13"
},
"target": {
"id": "@kernel.chat/kbot",
"source": {
"kind": "package",
"origin": "@kernel.chat/kbot"
},
"server": {
"name": "@kernel.chat/kbot"
}
},
"grade": "C",
"score": {
"score": 72,
"threatScore": 83,
"grade": "C",
"band": "C",
"categorySubtotals": {
"injection": 16.64,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-INJ-CMD-1",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"rawWeight": 3,
"confidenceMult": 0.4,
"diminishingFactor": 1,
"appliedPenalty": 1.2
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.5,
"appliedPenalty": 3.15
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.25,
"appliedPenalty": 1.58
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "client",
"term": "capability-exposure",
"level": "critical",
"label": "capability blast radius (critical) — client exposure if the model is manipulated",
"appliedPenalty": 10
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.13"
},
"capability": {
"level": "critical",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"can send data / act on an external service",
"can create, modify or delete files",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code",
"untrusted-input, sensitive-source and egress co-exist across tools (toxic-flow surface)",
"untrusted input can reach code execution"
],
"tags": [
"sensitive-source",
"file-write",
"code-exec",
"untrusted-input",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (27 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-FLOW-002",
"title": "Completed toxic-flow trifecta across tools",
"category": "exfiltration",
"severity": "critical",
"confidence": "strong",
"description": "This server (without client built-ins) exposes a complete data-exfiltration chain: kbot_github → kbot_bash. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.",
"remediation": "Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.",
"location": {
"kind": "flow",
"name": "kbot_github → kbot_bash"
},
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"untrusted": [
"kbot_github",
"kbot_grep"
],
"sources": [
"kbot_chat",
"kbot_edit_file",
"kbot_write_file",
"kbot_read_file",
"kbot_bash"
],
"sinks": [
"kbot_bash"
],
"path": [
"kbot_github",
"kbot_bash"
],
"edges": [
{
"from": "kbot_github",
"to": "kbot_bash",
"kind": "agent-mediated"
}
],
"wired": false
}
},
{
"ruleId": "MTC-FLOW-003",
"title": "Read-and-egress in one tool: \"kbot_bash\"",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "Tool \"kbot_bash\" can both read sensitive data and send data to an external destination. Even without an explicit untrusted-input leg, this is a single-call data-exfiltration path if the model is ever manipulated.",
"remediation": "Separate reading from sending; require explicit user confirmation before egress of file/secret contents.",
"location": {
"kind": "flow",
"name": "kbot_bash"
},
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (dist/personal-security.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/personal-security.js:216`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/personal-security.js"
},
"evidence": "if (entry === 'id_rsa' || entry === 'id_ed25519' || entry === 'id_ecdsa' || entry === 'id_dsa' || entry.startsW",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "dist/personal-security.js",
"line": 216,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (dist/tools/redblue.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/redblue.js:101`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/redblue.js"
},
"evidence": "'next.config.mjs', '.npmrc', '.yarnrc', '.babelrc', 'jest.config.ts', 'jest.config.js', 'vitest.con",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "dist/tools/redblue.js",
"line": 101,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-006",
"title": "Reads a sensitive credential path or dumps the environment (dist/tools/security-hunt.js)",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/security-hunt.js:170`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/security-hunt.js"
},
"evidence": "const dangerousFiles = ['.npmrc', '.pypirc', '.docker/config.json', '.aws/credentials']; for (const df of dangerousF",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-006",
"file": "dist/tools/security-hunt.js",
"line": 170,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"kbot_bash\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"kbot_bash\" appears to run shell commands or evaluate code (keyword \"bash\" in tool name, parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "kbot_bash"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/agents/security-rules.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/agents/security-rules.js:76`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/agents/security-rules.js"
},
"evidence": ", description: 'new Function() constructor', recommendation: 'Replace with predefined functions or sandb",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/agents/security-rules.js",
"line": 76,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/integrations/ableton-osc-installer.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/integrations/ableton-osc-installer.js:91`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/integrations/ableton-osc-installer.js"
},
"evidence": "result = eval(code, { 'song': self.song, 'app': self.manager.appl",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/integrations/ableton-osc-installer.js",
"line": 91,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/pair.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/pair.js:93`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/pair.js"
},
"evidence": "tructor — equivalent to eval()', severity: 'error' }, { pattern: /dangerouslySetInnerHTML/, message: 'dangerouslySet",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/pair.js",
"line": 93,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/reflection.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/reflection.js:96`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/reflection.js"
},
"evidence": "on\\s*\\(/i, issue: 'Used eval() or Function() constructor — potential code injection.' }, { pattern: /password\\s*",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/reflection.js",
"line": 96,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/tools/containers.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/containers.js:287`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/containers.js"
},
"evidence": "rip(); print(f\"Result: {eval(expr, {\\\\\"__builtins__\\\\\": {}}, vars(math))}\")'], { timeout: 10_000, maxBuffer: 1024 * 1024",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/tools/containers.js",
"line": 287,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/tools/redblue.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/redblue.js:481`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/redblue.js"
},
"evidence": "exploitation: 'new Function(\"return \" + userInput)() allows arbitrary code execution', }, { nam",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/tools/redblue.js",
"line": 481,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-001",
"title": "Dynamic code execution in server code (dist/tools/security-hunt.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/security-hunt.js:322`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/security-hunt.js"
},
"evidence": "fix: 'Remove eval(). Use JSON.parse() for data, or Function constructor with strict validation if absolutely",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-001",
"file": "dist/tools/security-hunt.js",
"line": 322,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/adapters/peekaboo/runner.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/adapters/peekaboo/runner.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/adapters/peekaboo/runner.js"
},
"evidence": "{ execFile } from 'node:child_process'; function resolveBinary() { return process.env.PEEKABOO_BIN && process.env.PE",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/adapters/peekaboo/runner.js",
"line": 7,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/agents/security-rules.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/agents/security-rules.js:83`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/agents/security-rules.js"
},
"evidence": ", description: 'exec(`... ${...}`) template literal', recommendation: 'Switch to execFile(cmd, [args]) —",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/agents/security-rules.js",
"line": 83,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/automations.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/automations.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/automations.js"
},
"evidence": "{ execSync } from 'node:child_process'; import { randomUUID, timingSafeEqual } from 'node:crypto'; // ── Paths ── const",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/automations.js",
"line": 15,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/autonomous-contributor.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/autonomous-contributor.js:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/autonomous-contributor.js"
},
"evidence": "{ execSync } from 'node:child_process'; // ── Constants ── const IGNORED_DIRS = new Set([ 'node_modules', '.git', 'd",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/autonomous-contributor.js",
"line": 14,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/bootstrap.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/bootstrap.js:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/bootstrap.js"
},
"evidence": "{ execSync } from 'node:child_process'; import chalk from 'chalk'; // ── Helpers ── function execQuiet(cmd, timeoutMs =",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/bootstrap.js",
"line": 20,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/bounty/hunter.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/bounty/hunter.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/bounty/hunter.js"
},
"evidence": "ecFileSync } from 'node:child_process'; import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs'; im",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/bounty/hunter.js",
"line": 19,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/bounty/solver.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/bounty/solver.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/bounty/solver.js"
},
"evidence": "ecFileSync } from 'node:child_process'; import { existsSync, rmSync } from 'node:fs'; import { join } from 'node:path';",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/bounty/solver.js",
"line": 12,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/build-targets.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/build-targets.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/build-targets.js"
},
"evidence": "{ execSync } from 'node:child_process'; import { join } from 'node:path'; export const BUILD_TARGETS = { // ── Mobil",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/build-targets.js",
"line": 7,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/changelog.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/changelog.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/changelog.js"
},
"evidence": "{ execSync } from 'node:child_process'; import { readFileSync } from 'node:fs'; import { join } from 'node:path'; import",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/changelog.js",
"line": 12,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/cli.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/cli.js:1628`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/cli.js"
},
"evidence": "} = await import('node:child_process'); execSync('echo ok', { timeout: 2000 }); system.reportHe",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/cli.js",
"line": 1628,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/bootstrap.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/bootstrap.js:57`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/bootstrap.js"
},
"evidence": "const res = await fetch(`https://api.github.com/repos/${repo}`, { headers: { 'User-Agent': 'kbot-boots",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/bootstrap.js",
"line": 57,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/briefing.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/briefing.js:37`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/briefing.js"
},
"evidence": "const fgRes = await fetch('https://api.alternative.me/fng/?limit=1', { signal: AbortSignal.timeout(5000) });",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/briefing.js",
"line": 37,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/cli.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/cli.js:1569`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/cli.js"
},
"evidence": "const res = await fetch(`https://eoxxpyixdieprsxlpwcs.supabase.co/functions/v1/forge-registry/search?q=${encodeURI",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/cli.js",
"line": 1569,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/community-manager.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/community-manager.js:224`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/community-manager.js"
},
"evidence": "const npmRes = await fetch('https://api.npmjs.org/downloads/point/last-week/@kernel.chat/kbot', { signal: AbortSignal",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/community-manager.js",
"line": 224,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/daemon.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/daemon.js:74`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/daemon.js"
},
"evidence": "const res = await fetch(`https://api.coingecko.com/api/v3/simple/price?ids=${ids}&vs_currencies=usd`, { signal: Ab",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/daemon.js",
"line": 74,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/discovery.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/discovery.js:216`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/discovery.js"
},
"evidence": "const pageRes = await fetch(`https://news.ycombinator.com/item?id=${itemId}`, { headers: { 'Cookie': confi",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/discovery.js",
"line": 216,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/email-agent.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/email-agent.js:205`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/email-agent.js"
},
"evidence": "const res = await fetch(`https://api.duckduckgo.com/?q=${encoded}&format=json&no_html=1&skip_disambig=1`, {",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/email-agent.js",
"line": 205,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/error-correction.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/error-correction.js:142`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/error-correction.js"
},
"evidence": "const res = await fetch('https://api.anthropic.com/v1/messages', { method: 'POST', headers",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/error-correction.js",
"line": 142,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/imessage-agent.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/imessage-agent.js:148`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/imessage-agent.js"
},
"evidence": "const res = await fetch(`https://api.duckduckgo.com/?q=${encoded}&format=json&no_html=1&skip_disambig=1`, {",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/imessage-agent.js",
"line": 148,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/interactive-buttons.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/interactive-buttons.js:121`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/interactive-buttons.js"
},
"evidence": "const res = await fetch('https://api.resend.com/emails', { method: 'POST', headers: {",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/interactive-buttons.js",
"line": 121,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/build-targets.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/build-targets.js:429`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/build-targets.js"
},
"evidence": "ol) { try { execSync(`which ${tool}`, { stdio: 'ignore', timeout: 3000 }); return true; } ca",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/build-targets.js",
"line": 429,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/cli.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/cli.js:2139`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/cli.js"
},
"evidence": "cess'); execSync(`ollama pull ${opts.model}`, { stdio: 'inherit', timeout: 600_000 }); p",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/cli.js",
"line": 2139,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/community-autopilot.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/community-autopilot.js:100`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/community-autopilot.js"
},
"evidence": "dy) { try { execSync(`gh issue comment ${issueNumber} --repo ${repo} --body ${JSON.stringify(body)}`, { time",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/community-autopilot.js",
"line": 100,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/community-manager.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/community-manager.js:80`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/community-manager.js"
},
"evidence": "dy) { try { execSync(`gh issue comment ${issueNumber} --repo ${repo} --body ${JSON.stringify(body)}`, { time",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/community-manager.js",
"line": 80,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/discovery.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/discovery.js:258`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/discovery.js"
},
"evidence": "alse; try { execSync(`gh issue comment ${match[2]} --repo ${match[1]} --body \"${comment.replace(/\"/g, '\\\\\"')",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/discovery.js",
"line": 258,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/evolution.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/evolution.js:147`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/evolution.js"
},
"evidence": "const result = execSync(`grep -rn \"TODO\\\\|FIXME\\\\|HACK\\\\|XXX\" \"${srcDir}\" --include=\"*.ts\" | head -20`, { encod",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/evolution.js",
"line": 147,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/github-release.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/github-release.js:34`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/github-release.js"
},
"evidence": "try { return execSync(`git ${cmd}`, { cwd: process.cwd(), encoding: 'utf-8',",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/github-release.js",
"line": 34,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/hooks.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/hooks.js:38`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/hooks.js"
},
"evidence": "const output = execSync(`sh \"${hookPath}\"`, { encoding: 'utf-8', timeout: 10000,",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/hooks.js",
"line": 38,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/ide/lsp-bridge.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/ide/lsp-bridge.js:36`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/ide/lsp-bridge.js"
},
"evidence": "hild_process'); execSync(`which ${serverCmd[0]}`, { stdio: 'ignore', timeout: 3000 }); return serverCmd;",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/ide/lsp-bridge.js",
"line": 36,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/integrations/ableton-osc-installer.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/integrations/ableton-osc-installer.js:123`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/integrations/ableton-osc-installer.js"
},
"evidence": "} try { execSync(`git clone --depth 1 ${REPO_URL} \"${tmpDir}\"`, { stdio: 'pipe' }); log(' Clone",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/integrations/ableton-osc-installer.js",
"line": 123,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-002",
"title": "Tool \"kbot_edit_file\" can modify the filesystem",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"kbot_edit_file\" can write, overwrite or delete files (keyword \"edit_file\" in tool name). Verify it is scoped to a safe directory.",
"remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
"location": {
"kind": "tool",
"name": "kbot_edit_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-002",
"title": "Tool \"kbot_write_file\" can modify the filesystem",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"kbot_write_file\" can write, overwrite or delete files (keyword \"write_file\" in tool name). Verify it is scoped to a safe directory.",
"remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
"location": {
"kind": "tool",
"name": "kbot_write_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"command\" on \"kbot_bash\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"kbot_bash\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "kbot_bash",
"field": "inputSchema.properties.command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "command"
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/inference.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/inference.js:17`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/inference.js"
},
"evidence": "{ return await import(LLAMA_MODULE); } catch { throw new Error('node-llama-cpp is not installed",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/inference.js",
"line": 17,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/plugin-sdk.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/plugin-sdk.js:149`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/plugin-sdk.js"
},
"evidence": "; const mod = await import(fileUrl); const plugin = mod.default || mod; // Validate required fields if (",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/plugin-sdk.js",
"line": 149,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/plugins.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/plugins.js:174`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/plugins.js"
},
"evidence": "const mod = await import(fileUrl); const definitions = []; if (mod.default) {",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/plugins.js",
"line": 174,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/tools/index.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/tools/index.js:286`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/index.js"
},
"evidence": "const imported = await import(mod.path); const registerFn = imported[mod.registerFn]; if (typeof regist",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/tools/index.js",
"line": 286,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"kbot_edit_file\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"kbot_edit_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "kbot_edit_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"kbot_write_file\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"kbot_write_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "kbot_write_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"kbot_bash\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"kbot_bash\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "kbot_bash"
},
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-INJ-CMD-1",
"title": "Shell command embedded in tool metadata",
"category": "injection",
"severity": "low",
"confidence": "heuristic",
"description": "Shell command embedded in tool metadata detected in the description of tool \"kbot_bash\". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.",
"remediation": "Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.",
"location": {
"kind": "tool",
"name": "kbot_bash",
"field": "description"
},
"evidence": "rm -rf",
"owasp": "LLM01:2025 Prompt Injection",
"data": {
"kind": "command-in-prose"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"kbot_edit_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"kbot_edit_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "kbot_edit_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"kbot_write_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"kbot_write_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "kbot_write_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"kbot_read_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"kbot_read_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "kbot_read_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "critical",
"confidence": "strong",
"untrustedInput": [
"kbot_github",
"kbot_grep"
],
"sensitiveSource": [
"kbot_chat",
"kbot_edit_file",
"kbot_write_file",
"kbot_read_file",
"kbot_bash"
],
"externalSink": [
"kbot_bash"
],
"selfContained": false,
"path": [
"kbot_github",
"kbot_bash"
],
"pathWired": false,
"description": "A cross-tool exfiltration chain exists: kbot_github → kbot_bash."
},
{
"id": "flow-2",
"severity": "high",
"confidence": "strong",
"untrustedInput": [],
"sensitiveSource": [
"kbot_bash"
],
"externalSink": [
"kbot_bash"
],
"selfContained": true,
"description": "Tool \"kbot_bash\" both reads sensitive data and can send it externally."
}
],
"capabilities": [
{
"tool": "kbot_reply",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_agent",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_tools",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_status",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_chat",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "kbot_edit_file",
"tags": [
"sensitive-source",
"file-write"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
],
"file-write": [
"keyword \"edit_file\" in tool name"
]
}
},
{
"tool": "kbot_write_file",
"tags": [
"sensitive-source",
"file-write"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
],
"file-write": [
"keyword \"write_file\" in tool name"
]
}
},
{
"tool": "kbot_read_file",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "kbot_bash",
"tags": [
"sensitive-source",
"code-exec"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
],
"code-exec": [
"keyword \"bash\" in tool name",
"parameter \"command\""
]
}
},
{
"tool": "kbot_search",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_github",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"web_search\""
]
}
},
{
"tool": "kbot_remember",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_diagnostics",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_plan",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_glob",
"tags": [],
"reasons": {}
},
{
"tool": "kbot_grep",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"web_search\""
]
}
},
{
"tool": "Project Context",
"tags": [],
"reasons": {}
},
{
"tool": "Persistent Memory",
"tags": [],
"reasons": {}
},
{
"tool": "Available Agents",
"tags": [],
"reasons": {}
},
{
"tool": "Saved Sessions",
"tags": [],
"reasons": {}
},
{
"tool": "explain_code",
"tags": [],
"reasons": {}
},
{
"tool": "code",
"tags": [],
"reasons": {}
},
{
"tool": "review_code",
"tags": [],
"reasons": {}
},
{
"tool": "fix_error",
"tags": [],
"reasons": {}
},
{
"tool": "error",
"tags": [],
"reasons": {}
},
{
"tool": "generate_tests",
"tags": [],
"reasons": {}
},
{
"tool": "refactor",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "a0b3b6d6e7fb2c94d6cfd51d6926e156d09bdc19b0385b853e98b3f25dc1b713",
"stats": {
"tools": 27,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 1,
"high": 22,
"medium": 27,
"low": 7,
"info": 0
}
}
}