Lasso MCP Server

In the server's implementation (`dist/desktop/desktop-doctor-checks.js:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import { promisify } from "node:util"; import { existsSync } from "node:fs"; //

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/desktop/desktop-doctor-checks.js

In the server's implementation (`dist/doctor/doctor.js:93`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from "node:child_process"; import { promisify } from "node:util"; import { promises as fs, constants as fsC

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/doctor/doctor.js

In the server's implementation (`dist/launcher/chrome-hide.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: , execFile } from "node:child_process"; import process from "node:process"; /** * 按 unix id 定向 hide 一个 Chrome 进程（AppleS

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/launcher/chrome-hide.js

In the server's implementation (`dist/launcher/chrome-hideshow-cli.js:28`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import process from "node:process"; import * as path from "node:path"; import os

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/launcher/chrome-hideshow-cli.js

In the server's implementation (`dist/launcher/chrome-stop.js:28`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { rmSync } from "node:fs"; import * as path from "node:path"; import proc

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/launcher/chrome-stop.js

In the server's implementation (`dist/launcher/desired-hide-enforcer.js:26`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { accessSync, readFileSync, writeFileSync, mkdirSync } from "node:fs"; im

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/launcher/desired-hide-enforcer.js

In the server's implementation (`dist/launcher/desired-hide-watchdog.js:25`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { readDesiredHiddenSync, rewriteDesiredHiddenSync, } from "./desired-hide

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/launcher/desired-hide-watchdog.js

In the server's implementation (`dist/launcher/launch-chrome.js:35`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { promises as fs, constants as fsConstants } from "node:fs"; import * as

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/launcher/launch-chrome.js

In the server's implementation (`dist/logged-in/keychain.js:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import { promisify } from "node:util"; import { randomBytes } from "node:crypto"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/logged-in/keychain.js

In the server's implementation (`dist/render/render-doctor.js:37`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { readdirSync, rmSync, statSync } from "node:fs"; import * as path from "

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/render/render-doctor.js

In the server's implementation (`dist/channels/BrowserbaseChannel.js:49`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: > { const r = await fetch("https://api.browserbase.com/v1/sessions", { method: "POST", headers: {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/channels/BrowserbaseChannel.js

In the server's implementation (`dist/doctor/doctor.js:2398`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const resp = await fetch("https://api.stagehand.dev/verify", { method: "HEAD", signal: Abor

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/doctor/doctor.js

In the server's implementation (`src/channels/BrowserbaseChannel.ts:74`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: => { const r = await fetch("https://api.browserbase.com/v1/sessions", { method: "POST", headers: { Auth

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/channels/BrowserbaseChannel.ts

In the server's implementation (`src/doctor/doctor.ts:3017`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const resp = await fetch("https://api.stagehand.dev/verify", { method: "HEAD", signal: AbortSignal.time

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/doctor/doctor.ts