Qwen Core — the complete, unedited output of the deterministic mcptrustchecker engine v1.9.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.9.0",
"methodologyVersion": "mcptrustchecker-1.9"
},
"target": {
"id": "qwen-core",
"source": {
"kind": "package",
"origin": "qwen-core"
},
"server": {
"name": "qwen-core"
}
},
"grade": "B",
"score": {
"score": 89,
"threatScore": 100,
"grade": "B",
"band": "B",
"categorySubtotals": {
"injection": 0,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "client",
"term": "capability-exposure",
"level": "critical",
"label": "capability blast radius (critical) — client exposure if the model is manipulated",
"appliedPenalty": 10
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.9"
},
"capability": {
"level": "critical",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"can send data / act on an external service",
"can create, modify or delete files",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code",
"untrusted-input, sensitive-source and egress co-exist across tools (toxic-flow surface)",
"untrusted input can reach code execution"
],
"tags": [
"sensitive-source",
"code-exec",
"file-write",
"untrusted-input",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (53 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-FLOW-002",
"title": "Completed toxic-flow trifecta across tools",
"category": "exfiltration",
"severity": "critical",
"confidence": "strong",
"description": "This server (without client built-ins) exposes a complete data-exfiltration chain: web_fetch → bash → execute_command. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.",
"remediation": "Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.",
"location": {
"kind": "flow",
"name": "web_fetch → bash → execute_command"
},
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"untrusted": [
"web_fetch",
"web_search"
],
"sources": [
"bash",
"read_file",
"write_file",
"edit_file",
"glob_search",
"grep_search",
"sequential_thinking",
"read_text_file",
"read_multiple_files",
"list_directory",
"directory_tree",
"search_files",
"get_file_info",
"execute_command",
"load_category"
],
"sinks": [
"bash",
"execute_command"
],
"path": [
"web_fetch",
"bash",
"execute_command"
],
"edges": [
{
"from": "web_fetch",
"to": "bash",
"kind": "agent-mediated"
},
{
"from": "bash",
"to": "execute_command",
"kind": "agent-mediated"
}
],
"wired": false
}
},
{
"ruleId": "MTC-FLOW-003",
"title": "Read-and-egress in one tool: \"bash\"",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "Tool \"bash\" can both read sensitive data and send data to an external destination. Even without an explicit untrusted-input leg, this is a single-call data-exfiltration path if the model is ever manipulated.",
"remediation": "Separate reading from sending; require explicit user confirmation before egress of file/secret contents.",
"location": {
"kind": "flow",
"name": "bash"
},
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-FLOW-003",
"title": "Read-and-egress in one tool: \"execute_command\"",
"category": "exfiltration",
"severity": "high",
"confidence": "strong",
"description": "Tool \"execute_command\" can both read sensitive data and send data to an external destination. Even without an explicit untrusted-input leg, this is a single-call data-exfiltration path if the model is ever manipulated.",
"remediation": "Separate reading from sending; require explicit user confirmation before egress of file/secret contents.",
"location": {
"kind": "flow",
"name": "execute_command"
},
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"references": [],
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"bash\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"bash\" appears to run shell commands or evaluate code (keyword \"bash\" in tool name, parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "bash"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-001",
"title": "Tool \"execute_command\" exposes command/code execution",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "Tool \"execute_command\" appears to run shell commands or evaluate code (keyword \"execute command\" in tool name, parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
"remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
"location": {
"kind": "tool",
"name": "execute_command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/agent/AutonomousAgent.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/agent/AutonomousAgent.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/agent/AutonomousAgent.js"
},
"evidence": "import { exec } from 'child_process'; import { promisify } from 'util'; const execAsync = promisify(exec); export clas",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/agent/AutonomousAgent.js",
"line": 1,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/index.mjs)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/index.mjs:155`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/index.mjs"
},
"evidence": "; import { exec } from \"child_process\"; import { promisify } from \"util\"; function getAutonomousAgent(config) { if (!a",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/index.mjs",
"line": 155,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/tools/BashTool.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/BashTool.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/BashTool.js"
},
"evidence": "; import { exec } from 'child_process'; import { promisify } from 'util'; import { BaseTool } from './BaseTool.js'; cons",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/tools/BashTool.js",
"line": 2,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/tools/GrepTool.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/tools/GrepTool.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/tools/GrepTool.js"
},
"evidence": "; import { exec } from 'child_process'; import { promisify } from 'util'; import * as path from 'path'; import { BaseToo",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/tools/GrepTool.js",
"line": 2,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/index.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/index.js:1768`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/index.js"
},
"evidence": "const res = await fetch(`https://duckduckgo.com/html?q=${query}&kl=wt-wt`, { headers: { \"User-",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/index.js",
"line": 1768,
"nonRuntime": false
}
},
{
"ruleId": "MTC-CAP-007",
"title": "Unconstrained URL/host parameter \"url\" on \"web_fetch\"",
"category": "network",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"web_fetch\" takes a URL/host parameter \"url\" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).",
"remediation": "Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.",
"location": {
"kind": "tool",
"name": "web_fetch",
"field": "inputSchema.properties.url"
},
"owasp": "LLM06:2025 Excessive Agency",
"data": {
"param": "url"
}
},
{
"ruleId": "MTC-CAP-002",
"title": "Tool \"write_file\" can modify the filesystem",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"write_file\" can write, overwrite or delete files (keyword \"write_file\" in tool name). Verify it is scoped to a safe directory.",
"remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
"location": {
"kind": "tool",
"name": "write_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-002",
"title": "Tool \"edit_file\" can modify the filesystem",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"edit_file\" can write, overwrite or delete files (keyword \"edit_file\" in tool name). Verify it is scoped to a safe directory.",
"remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
"location": {
"kind": "tool",
"name": "edit_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-002",
"title": "Tool \"move_file\" can modify the filesystem",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"move_file\" can write, overwrite or delete files (keyword \"move_file\" in tool name). Verify it is scoped to a safe directory.",
"remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
"location": {
"kind": "tool",
"name": "move_file"
},
"data": {
"tags": [
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-002",
"title": "Tool \"delete_file\" can modify the filesystem",
"category": "permissions",
"severity": "medium",
"confidence": "strong",
"description": "Tool \"delete_file\" can write, overwrite or delete files (keyword \"delete_file\" in tool name). Verify it is scoped to a safe directory.",
"remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
"location": {
"kind": "tool",
"name": "delete_file"
},
"data": {
"tags": [
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"command\" on \"bash\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"bash\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "bash",
"field": "inputSchema.properties.command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "command"
}
},
{
"ruleId": "MTC-CAP-006",
"title": "Unconstrained command parameter \"command\" on \"execute_command\"",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "Tool \"execute_command\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
"remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
"location": {
"kind": "tool",
"name": "execute_command",
"field": "inputSchema.properties.command"
},
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"param": "command"
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"bash\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"bash\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "bash"
},
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"write_file\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"write_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "write_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"edit_file\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"edit_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "edit_file"
},
"data": {
"tags": [
"sensitive-source",
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"move_file\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"move_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "move_file"
},
"data": {
"tags": [
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"delete_file\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"delete_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "delete_file"
},
"data": {
"tags": [
"file-write"
]
}
},
{
"ruleId": "MTC-CAP-005",
"title": "Mutating tool \"execute_command\" declares no destructiveHint",
"category": "hygiene",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"execute_command\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
"remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
"location": {
"kind": "tool",
"name": "execute_command"
},
"data": {
"tags": [
"sensitive-source",
"code-exec"
]
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"read_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"read_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "read_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"write_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"write_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "write_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"edit_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"edit_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "edit_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"grep_search\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"grep_search\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "grep_search",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"read_text_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"read_text_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "read_text_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"list_directory\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"list_directory\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "list_directory",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"directory_tree\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"directory_tree\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "directory_tree",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"search_files\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"search_files\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "search_files",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"get_file_info\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"get_file_info\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "get_file_info",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
},
{
"ruleId": "MTC-CAP-008",
"title": "Unconstrained path parameter \"path\" on \"delete_file\"",
"category": "permissions",
"severity": "low",
"confidence": "heuristic",
"description": "Tool \"delete_file\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
"remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
"location": {
"kind": "tool",
"name": "delete_file",
"field": "inputSchema.properties.path"
},
"data": {
"param": "path"
}
}
],
"toxicFlows": [
{
"id": "flow-1",
"severity": "critical",
"confidence": "strong",
"untrustedInput": [
"web_fetch",
"web_search"
],
"sensitiveSource": [
"bash",
"read_file",
"write_file",
"edit_file",
"glob_search",
"grep_search",
"sequential_thinking",
"read_text_file",
"read_multiple_files",
"list_directory",
"directory_tree",
"search_files",
"get_file_info",
"execute_command",
"load_category"
],
"externalSink": [
"bash",
"execute_command"
],
"selfContained": false,
"path": [
"web_fetch",
"bash",
"execute_command"
],
"pathWired": false,
"description": "A cross-tool exfiltration chain exists: web_fetch → bash → execute_command."
},
{
"id": "flow-2",
"severity": "high",
"confidence": "strong",
"untrustedInput": [],
"sensitiveSource": [
"bash"
],
"externalSink": [
"bash"
],
"selfContained": true,
"description": "Tool \"bash\" both reads sensitive data and can send it externally."
},
{
"id": "flow-3",
"severity": "high",
"confidence": "strong",
"untrustedInput": [],
"sensitiveSource": [
"execute_command"
],
"externalSink": [
"execute_command"
],
"selfContained": true,
"description": "Tool \"execute_command\" both reads sensitive data and can send it externally."
}
],
"capabilities": [
{
"tool": "bash",
"tags": [
"sensitive-source",
"code-exec"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
],
"code-exec": [
"keyword \"bash\" in tool name",
"parameter \"command\""
]
}
},
{
"tool": "read_file",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "write_file",
"tags": [
"sensitive-source",
"file-write"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
],
"file-write": [
"keyword \"write_file\" in tool name"
]
}
},
{
"tool": "edit_file",
"tags": [
"sensitive-source",
"file-write"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
],
"file-write": [
"keyword \"edit_file\" in tool name"
]
}
},
{
"tool": "glob_search",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "grep_search",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "web_fetch",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"fetch_url\""
]
}
},
{
"tool": "web_search",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"fetch\""
]
}
},
{
"tool": "todo_write",
"tags": [],
"reasons": {}
},
{
"tool": "ask_user",
"tags": [],
"reasons": {}
},
{
"tool": "sequential_thinking",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "autonomous_agent",
"tags": [],
"reasons": {}
},
{
"tool": "error_memory_status",
"tags": [],
"reasons": {}
},
{
"tool": "clear_error_memory",
"tags": [],
"reasons": {}
},
{
"tool": "git_status",
"tags": [],
"reasons": {}
},
{
"tool": "git_diff",
"tags": [],
"reasons": {}
},
{
"tool": "git_commit",
"tags": [],
"reasons": {}
},
{
"tool": "git_add",
"tags": [],
"reasons": {}
},
{
"tool": "git_log",
"tags": [],
"reasons": {}
},
{
"tool": "get_current_time",
"tags": [],
"reasons": {}
},
{
"tool": "convert_time",
"tags": [],
"reasons": {}
},
{
"tool": "read_pdf",
"tags": [],
"reasons": {}
},
{
"tool": "list_skills",
"tags": [],
"reasons": {}
},
{
"tool": "frontend-design",
"tags": [],
"reasons": {}
},
{
"tool": "read_text_file",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "read_multiple_files",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "list_directory",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "list_directory_with_sizes",
"tags": [],
"reasons": {}
},
{
"tool": "directory_tree",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "create_directory",
"tags": [],
"reasons": {}
},
{
"tool": "move_file",
"tags": [
"file-write"
],
"reasons": {
"file-write": [
"keyword \"move_file\" in tool name"
]
}
},
{
"tool": "search_files",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "get_file_info",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "delete_file",
"tags": [
"file-write"
],
"reasons": {
"file-write": [
"keyword \"delete_file\" in tool name"
]
}
},
{
"tool": "delete_directory",
"tags": [],
"reasons": {}
},
{
"tool": "execute_command",
"tags": [
"sensitive-source",
"code-exec"
],
"reasons": {
"sensitive-source": [
"keyword \"cat_file\""
],
"code-exec": [
"keyword \"execute command\" in tool name",
"parameter \"command\""
]
}
},
{
"tool": "list_processes",
"tags": [],
"reasons": {}
},
{
"tool": "kill_process",
"tags": [],
"reasons": {}
},
{
"tool": "autonomous-agent",
"tags": [],
"reasons": {}
},
{
"tool": "skill-loader",
"tags": [],
"reasons": {}
},
{
"tool": "skillName",
"tags": [],
"reasons": {}
},
{
"tool": "task-planner",
"tags": [],
"reasons": {}
},
{
"tool": "task",
"tags": [],
"reasons": {}
},
{
"tool": "qwen-core",
"tags": [],
"reasons": {}
},
{
"tool": "list_categories",
"tags": [],
"reasons": {}
},
{
"tool": "load_category",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"read_file\""
]
}
},
{
"tool": "think-first",
"tags": [],
"reasons": {}
},
{
"tool": "category-gateway",
"tags": [],
"reasons": {}
},
{
"tool": "intent",
"tags": [],
"reasons": {}
},
{
"tool": "skill-auto-loader",
"tags": [],
"reasons": {}
},
{
"tool": "context",
"tags": [],
"reasons": {}
},
{
"tool": "slash-command",
"tags": [],
"reasons": {}
},
{
"tool": "command",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "f924306ac3ced4e6b67271ef5ea3a4333c1a5d7672e6136fcde50196ea728a39",
"stats": {
"tools": 53,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 1,
"high": 8,
"medium": 8,
"low": 16,
"info": 0
}
}
}