Xcode (onmyway133) MCP Server

In the server's implementation (`dist/index.js:2875`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); const val

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/index.js:33755`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t { exec, spawn } from "child_process"; import { promisify } from "util"; var execAsync = promisify(exec); class Comman

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/programs/command-executor.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t { exec, spawn } from 'child_process'; import { promisify } from 'util'; const execAsync = promisify(exec); export clas

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/command-executor.js

In the server's implementation (`dist/programs/simulator-control/app-management.js:68`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } export async function spawn(core, deviceId, command, args = []) { const argsStr = args.map((a) => `"${a}"`).join('

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/simulator-control/app-management.js

In the server's implementation (`dist/programs/simulator-control/app.js:85`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } export async function spawn(deviceId, command, args = []) { const argsStr = args.map((a) => `"${a}"`).join(' ');

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/simulator-control/app.js

In the server's implementation (`dist/programs/simulator-control/io-operations.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: as spawnProcess } from 'child_process'; import { existsSync } from 'fs'; export async function screenshot(core, deviceId

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/simulator-control/io-operations.js

In the server's implementation (`dist/programs/simulator-control/io.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: as spawnProcess } from 'child_process'; import { existsSync } from 'fs'; export async function screenshot(deviceId, outp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/simulator-control/io.js

In the server's implementation (`dist/programs/simulator-control/pasteboard.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from 'child_process'; import { executeSimctl } from './core.js'; export async function copyToPasteboar

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/simulator-control/pasteboard.js

In the server's implementation (`dist/programs/simulator-control/video.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from 'child_process'; import { existsSync, unlinkSync } from 'fs'; let activeRecording = null; export

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/simulator-control/video.js

In the server's implementation (`dist/programs/simulator-program.js:158`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const child = require('child_process').spawn('sh', ['-c', args.join(' ')], { detached: true, });

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/programs/simulator-program.js

In the server's implementation (`src/programs/command-executor.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t { exec, spawn } from 'child_process'; import { promisify } from 'util'; import type { CommandResult } from '../types.j

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/programs/command-executor.ts

Tool "notarize_list_signing_identities" describes a credential store (SSH keys, cloud credentials, a keychain or an equivalent) that nothing in its input schema can address. A tool's interface is the honest statement of what it touches; prose that reaches past it is addressed to the model, not to a reader.

Evidence: keychain

Fix: Remove the reference, or expose the target as an explicit, validated parameter so the client can see and consent to what the tool reads.

Location: tool notarize_list_signing_identities · description