Oss Autopilot MCP Server

In the server's implementation (`dist/mcp-server.bundle.cjs:62`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ode.process(l,e));let m=new Function(`${Ci.default.self}`,`${Ci.default.scope}`,l)(this,this.scope.get());if(this.scope.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/mcp-server.bundle.cjs

In the server's implementation (`dist/mcp-server.bundle.cjs:146`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: trict";Ip=require("node:child_process");Te();Ce();Wi="auth",Gr=null,Ki=!1;E8=/^[\da-z](?:[\da-z]|-(?=[\da-z])){0,38}$/i}

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/mcp-server.bundle.cjs

Untrusted-input tools ([comments, guidelines-fetch-corpus]) co-exist with external-action tools ([daily, status, search, verify-issue]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [comments, guidelines-fetch-corpus] → sinks [daily, status, search, verify-issue]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow comments → daily

Tool "state-unlink" can write, overwrite or delete files (keyword "unlink" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool state-unlink

Tool "state-unlink" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool state-unlink