Picklab MCP Server

Tools that read sensitive data ([android_get_ui_tree, android_logcat]) and tools that can send data out ([desktop_launch]) are exposed together. An agent can move private data to the sink.

Evidence: sources [android_get_ui_tree, android_logcat] → sinks [desktop_launch]

Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.

Location: flow android_get_ui_tree → desktop_launch

Tool "desktop_launch" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool desktop_launch

In the server's implementation (`dist/chunk-4LAX4KPK.js:1150`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import { once } from "events"; import crypto from "crypto"; import fs32 from "fs

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-4LAX4KPK.js

In the server's implementation (`dist/chunk-HLP5F24F.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; import fs6 from "fs"; import path6 from "path"; import fs8 from "fs"; import pat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/chunk-HLP5F24F.js

In the server's implementation (`dist/program-4K4UBGBH.js:383`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: import { spawn } from "child_process"; async function runArtifactsList(opts) { return runReported(opts, async () => {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/program-4K4UBGBH.js

Tool "desktop_launch" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.

Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.

Location: tool desktop_launch · inputSchema.properties.command

Tool "desktop_launch" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool desktop_launch