Memorix MCP Server

In the server's implementation (`dist/cli/memcode.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ync as __ms} from "node:child_process"; import {fileURLToPath as __fu} from "node:url"; if(!process.env.__MEMORIX_HEAP){

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/cli/memcode.js

In the server's implementation (`plugins/hermes/memorix/__init__.py:20`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: try: result = subprocess.run( command, input=input_data, capture_output=Tr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugins/hermes/memorix/__init__.py

In the server's implementation (`plugins/omp/memorix/extensions/memorix.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; const SESSION_ID = `omp-${Date.now().toString(36)}-${Math.random().toString(36)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugins/omp/memorix/extensions/memorix.js

In the server's implementation (`plugins/openclaw/memorix/hooks/memorix/handler.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; const SESSION_ID = `openclaw-${Date.now().toString(36)}-${Math.random().toStrin

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugins/openclaw/memorix/hooks/memorix/handler.ts

In the server's implementation (`plugins/pi/memorix/extensions/memorix.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; const SESSION_ID = `pi-${Date.now().toString(36)}-${Math.random().toString(36).

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server plugins/pi/memorix/extensions/memorix.js

In the server's implementation (`src/cli/commands/agent-integrations.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync, realpathSync } from 'node:fs'; import { mkdir, readFile, wr

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/commands/agent-integrations.ts

In the server's implementation (`src/cli/commands/background.ts:24`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; import { randomBytes } from 'node:crypto'; import os from 'node:os'; import { pa

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/commands/background.ts

In the server's implementation (`src/cli/commands/doctor.ts:54`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import('node:child_process'); const report: Record<string, unknown> = {}; const issues: string[] = [

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/commands/doctor.ts

In the server's implementation (`src/cli/commands/hooks-install.ts:130`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } = await import('node:child_process'); execSync('pwsh --version', { encoding: 'utf-8', tim

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/commands/hooks-install.ts

In the server's implementation (`src/cli/tui/App.tsx:828`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rd) { try { execSync(`start "" "${background.dashboard}"`, { stdio: 'pipe', windowsHide: true }); } catch {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/tui/App.tsx

In a packaging/dev/install script (shipped, but not the server runtime) (`src/cli/commands/setup.ts:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync } from 'node:fs'; import { copyFile, mkdir, readFile, readdi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/cli/commands/setup.ts