Admin (sellable) MCP Server

In the server's implementation (`dist/lib/hermesExactPackageLauncher.js:18`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: onst npmrc = join(home, ".npmrc"); writeFileSync(npmrc, [ "registry=https://registry.npmjs.org/", "i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/lib/hermesExactPackageLauncher.js

In the server's implementation (`dist/lib/admin-state-lock.mjs:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: childProcess from "node:child_process"; export const ADMIN_STATE_LOCK_VERSION = 2; export const ADMIN_STATE_LOCK_SUFFIX

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/lib/admin-state-lock.mjs

In the server's implementation (`dist/lib/agentConsole.js:70`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: '\\"import base64,sys;exec(base64.b64decode(sys.argv[1]))\\" ' + `${encoded} ${marker}`); } /** True when `pat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/lib/agentConsole.js

In the server's implementation (`dist/lib/hermesExactPackageLauncher.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rt { spawn } from "node:child_process"; import { createHash } from "node:crypto"; import { chmodSync, existsSync, lstatS

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/lib/hermesExactPackageLauncher.js

In the server's implementation (`dist/tools/customerEvidence.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import path from "node:path"; import { getAdminHomeDir } from "../paths.js"; imp

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/customerEvidence.js

In the server's implementation (`dist/tools/hermesInternalOnboardingSlackCli.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { createHash } from "node:crypto"; import { existsSync, lstatSync, readFi

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/hermesInternalOnboardingSlackCli.js

In the server's implementation (`dist/tools/hermesOnboardingAgent.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import { accessSync, chmodSync, constants, existsSync, lstatSync, mkdirSync, rea

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/hermesOnboardingAgent.js

In the server's implementation (`dist/tools/lightfield.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFile } from "node:child_process"; import { resolve } from "node:path"; import { promisify } from "node:util"; impo

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/lightfield.js

In the server's implementation (`dist/tools/notionPublisher.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { existsSync, readFileSync } from "node:fs"; import { getFullConfig } fro

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/notionPublisher.js

In the server's implementation (`dist/tools/dashboard.js:367`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { const res = await fetch(`https://slack.com/api/${method}`, { method: "POST", headers: {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tools/dashboard.js

In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/agent-console.mjs:22`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from "node:child_process"; import { randomBytes } from "node:crypto"; import { createConnection } from "nod

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server scripts/agent-console.mjs

In a packaging/dev/install script (shipped, but not the server runtime) (`skills/opportunity-sequences/scripts/journal.py:529`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ]) children = [subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True) for command

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server skills/opportunity-sequences/scripts/journal.py