Media Gen (wangdong233) MCP Server

In the server's implementation (`dist/providers/flow.js:391`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .value; } async eval(expr, timeoutMs) { try { return await this.evalOnce(expr, timeoutMs);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/providers/flow.js

In the server's implementation (`dist/providers/flow.js:391`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .value; } async eval(expr, timeoutMs) { try { return await this.evalOnce(expr, timeoutMs);

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/providers/flow.js

In the server's implementation (`dist/browser-pool.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import { promisify } from "node:util"; import path from "node:path"; /** * brow

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/browser-pool.js

In the server's implementation (`dist/checks/output-checker.js:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import path from "node:path"; import { createRequire } from "node:module"; // ──

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/checks/output-checker.js

In the server's implementation (`dist/render-video.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import fs from "node:fs"; import path from "node:path"; import os from "node:os"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/render-video.js

In the server's implementation (`dist/providers/flow.js:297`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const res = await fetch(`http://${CDP_HOST}:${this.port}/json/list`, { signal: AbortSignal.timeout

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/providers/flow.js

A hardcoded Google API key (a client API key (restricted by referrer/quota, not a private secret)) appears in `dist/providers/flow.js:37`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: Google API key: AIza…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server dist/providers/flow.js