Wordpress (respira) MCP Server

In the server's implementation (`dist/agent-signature.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execSync } from 'node:child_process'; const MAX_HEADER_VALUE = 64; /** * The MCP initialize handshake carries the cli

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/agent-signature.js

In the server's implementation (`dist/server.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: port { execSync } from 'child_process'; import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs'; import

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server.js

In the server's implementation (`dist/system-ca.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; import { existsSync, readFileSync } from 'node:fs'; import { Agent as HttpsAgent

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/system-ca.js

In the server's implementation (`dist/agent-signature.js:83`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const output = execSync(`ps -o command= -p ${process.ppid}`, { encoding: 'utf8', stdio:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/agent-signature.js

A hardcoded PEM private key (a live-looking credential hardcoded in shipped code) appears in `dist/__tests__/system-ca.test.js:66`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: PEM private key: ----…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server dist/__tests__/system-ca.test.js