Safari (achiya-automation) MCP Server

In the server's implementation (`safari.js:4249`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ssh', '.gnupg', '.aws', '.config/gcloud', 'credentials', '.env', '.npmrc', '.netrc', 'id_rsa', 'id_ed25519', '.keychain'

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server safari.js

Tool "safari_eval_file" appears to run shell commands or evaluate code (keyword "eval" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool safari_eval_file

Tool "safari_run_script" appears to run shell commands or evaluate code (keyword "run_script" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool safari_run_script

In the server's implementation (`index.js:23`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from "node:child_process"; import { readFileSync, writeFileSync, existsSync, mkdirSync, unlinkSync, renameS

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server index.js

In the server's implementation (`safari.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { promisify } from "node:util"; import { tmpdir, homedir } from "node:os"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server safari.js

Untrusted-input tools ([safari_evaluate, safari_mock_route, safari_start_network_capture, safari_extract_meta]) co-exist with external-action tools ([safari_eval_file, safari_upload_file, safari_run_script]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [safari_evaluate, safari_mock_route, safari_start_network_capture, safari_extract_meta] → sinks [safari_eval_file, safari_upload_file, safari_run_scri

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow safari_evaluate → safari_eval_file

Tool "safari_eval_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool safari_eval_file

Tool "safari_run_script" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool safari_run_script

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/postinstall.cjs:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } = require("child_process"); const fs = require("fs"); const c = { reset: "\x1b[0m", bold: "\x1b[1m",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/postinstall.cjs

"safari-mcp" executes postinstall script(s) at install time. An install hook runs at install time; most are routine build/setup, but review what it does before trusting it.

Evidence: node scripts/postinstall.cjs || true

Fix: Review the scripts; install with --ignore-scripts where possible and vet what they do.

Location: package safari-mcp