Prjct Cli MCP Server

In the server's implementation (`dist/bin/core-chunks/chunk-HZTC77KI.mjs:7`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .*\.(?:pem|key|p12|pfx)|id_rsa|id_ed25519|credentials\.json|auth\.json)$/i,ee=/(?:^|\/)(?:\.ssh|\.gnupg|\.aws|\.config\/

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/chunk-HZTC77KI.mjs

In the server's implementation (`dist/bin/hook-chunks/chunk-2E6JLR2S.mjs:8`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: .*\.(?:pem|key|p12|pfx)|id_rsa|id_ed25519|credentials\.json|auth\.json)$/i,Ot=/(?:^|\/)(?:\.ssh|\.gnupg|\.aws|\.config\/

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/hook-chunks/chunk-2E6JLR2S.mjs

In the server's implementation (`bin/prjct.cjs:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: Process = require('node:child_process') const fs = require('node:fs') const os = require('node:os') const path = require

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/prjct.cjs

In the server's implementation (`dist/bin/core-chunks/ab-3VUQJGO4.mjs:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e,spawn as Oe}from"node:child_process";import G from"node:fs";import k from"node:fs/promises";import $e from"node:os";im

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/ab-3VUQJGO4.mjs

In the server's implementation (`dist/bin/core-chunks/agent-LRU4TTKX.mjs:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: xecFile as ft}from"node:child_process";import S from"node:fs";import{promisify as gt}from"node:util";function b(t){retur

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/agent-LRU4TTKX.mjs

In the server's implementation (`dist/bin/core-chunks/auto-updater-ETKWRLKZ.mjs:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: f,spawn as w}from"node:child_process";import r from"node:fs";import o from"node:path";var d=e(()=>o.join(c(),"state"),"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/auto-updater-ETKWRLKZ.mjs

In the server's implementation (`dist/bin/core-chunks/bin-commands-NASQLNW6.mjs:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n:l}=await import("node:child_process"),d=l("tail",["-n",String(r),"-f",n],{stdio:"inherit"});process.on("SIGINT",()=>d.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/bin-commands-NASQLNW6.mjs

In the server's implementation (`dist/bin/core-chunks/chunk-3DDHVWTV.mjs:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n:c}=await import("node:child_process"),l=c("/bin/sh",["-c","command -v prjct >/dev/null 2>&1 && prjct gauntlet >/dev/nu

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/chunk-3DDHVWTV.mjs

In the server's implementation (`dist/bin/core-chunks/chunk-65R3C7IA.mjs:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: t.","","### Continue vs spawn (multi-agent)","","| Situation | Action | Why |","|---|---|---|","| Explore already loaded

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/chunk-65R3C7IA.mjs

In the server's implementation (`dist/bin/core-chunks/chunk-A6IDYEDB.mjs:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt{spawn as W}from"node:child_process";import se from"node:path";var Y=6e4,G=500,oe=2e3;function j(e,a){try{process.plat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/chunk-A6IDYEDB.mjs

In the server's implementation (`dist/bin/core-chunks/chunk-HZTC77KI.mjs:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: xecSync as qe}from"node:child_process";import ot from"node:fs/promises";import V from"node:path";import R from"chalk";im

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/chunk-HZTC77KI.mjs

In the server's implementation (`dist/bin/core-chunks/chunk-LBVVLD7L.mjs:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: K,spawn as $}from"node:child_process";import{promisify as C}from"node:util";async function G(e){try{process.platform===

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/bin/core-chunks/chunk-LBVVLD7L.mjs