Superbased — the complete, unedited output of the deterministic mcptrustchecker engine v1.8.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.
{
"tool": {
"name": "mcptrustchecker",
"version": "1.8.0",
"methodologyVersion": "mcptrustchecker-1.8"
},
"target": {
"id": "superbased",
"source": {
"kind": "package",
"origin": "superbased"
},
"server": {
"name": "superbased"
}
},
"grade": "C",
"score": {
"score": 74,
"threatScore": 85,
"grade": "C",
"band": "C",
"categorySubtotals": {
"injection": 15.44,
"exfiltration": 0,
"permissions": 0,
"supply-chain": 0,
"network": 0,
"hygiene": 0
},
"vector": [
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 1,
"appliedPenalty": 6.3
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.5,
"appliedPenalty": 3.15
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.25,
"appliedPenalty": 1.58
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "threat",
"ruleId": "MTC-SRC-009",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"rawWeight": 9,
"confidenceMult": 0.7,
"diminishingFactor": 0.1,
"appliedPenalty": 0.63
},
{
"kind": "client",
"term": "capability-exposure",
"level": "critical",
"label": "capability blast radius (critical) — client exposure if the model is manipulated",
"appliedPenalty": 10
},
{
"kind": "client",
"term": "verification-discount",
"level": "repo",
"label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
"appliedPenalty": 1
},
{
"kind": "client",
"term": "coverage-honesty",
"level": "source",
"label": "inspection depth (source) — how much of the target the scan could see",
"appliedPenalty": 0
}
],
"gatesFired": [],
"methodologyVersion": "mcptrustchecker-1.8"
},
"capability": {
"level": "critical",
"reasons": [
"ingests untrusted external content (a prompt-injection entry point)",
"can send data / act on an external service",
"reads sensitive or local data",
"has a read → egress path (a data-exfiltration surface)",
"can execute shell commands or code",
"untrusted input can reach code execution"
],
"tags": [
"untrusted-input",
"sensitive-source",
"code-exec",
"external-sink"
]
},
"coverage": {
"level": "source",
"inputs": {
"toolSurface": true,
"implementationSource": true,
"packageMetadata": true,
"liveTransport": false
},
"caveats": [
"Tools were statically extracted from the published source (72 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
]
},
"findings": [
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/core/input-injection/windows.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/core/input-injection/windows.js:47`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/core/input-injection/windows.js"
},
"evidence": "= __importStar(require(\"child_process\")); const logger_1 = __importDefault(require(\"../../logger\")); // Inline C# using",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/core/input-injection/windows.js",
"line": 47,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/main.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/main.js:1971`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/main.js"
},
"evidence": "{ execSync } = require('child_process'); if (process.platform === 'darwin') { execSync(`osas",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/main.js",
"line": 1971,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/context-menu-detect.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/context-menu-detect.js:59`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/context-menu-detect.js"
},
"evidence": "= __importStar(require(\"child_process\")); const fs = __importStar(require(\"fs\")); const os = __importStar(require(\"os\"))",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/context-menu-detect.js",
"line": 59,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/platform/dpi.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/dpi.js:32`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/dpi.js"
},
"evidence": "ecFileSync } = require('child_process'); const out = execFileSync('reg', ['query', 'HKCU\\\\Control Panel\\\\Des",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/platform/dpi.js",
"line": 32,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/platform/macos/ax.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/macos/ax.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/macos/ax.js"
},
"evidence": "Adapter = void 0; const child_process_1 = require(\"child_process\"); const errors_1 = require(\"../errors\"); const shared_",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/platform/macos/ax.js",
"line": 13,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/platform/macos/capture.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/macos/capture.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/macos/capture.js"
},
"evidence": "Adapter = void 0; const child_process_1 = require(\"child_process\"); const shared_1 = require(\"../shared\"); const capture",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/platform/macos/capture.js",
"line": 13,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/platform/macos/launch.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/macos/launch.js:19`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/macos/launch.js"
},
"evidence": "Adapter = void 0; const child_process_1 = require(\"child_process\"); const errors_1 = require(\"../errors\"); const shared_",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/platform/macos/launch.js",
"line": 19,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/platform/macos/window.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/macos/window.js:26`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/macos/window.js"
},
"evidence": "Adapter = void 0; const child_process_1 = require(\"child_process\"); const errors_1 = require(\"../errors\"); const shared_",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/platform/macos/window.js",
"line": 26,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/platform/shared.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/shared.js:110`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/shared.js"
},
"evidence": "childProcess = require('child_process'); const script = pathMod.join(os.tmpdir(), `superbased-displays-${Date.no",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/platform/shared.js",
"line": 110,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-002",
"title": "Shell/command execution in server code (dist/electron/modules/platform/windows/ax.js)",
"category": "permissions",
"severity": "high",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/windows/ax.js:44`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/windows/ax.js"
},
"evidence": "= __importStar(require(\"child_process\")); const fs = __importStar(require(\"fs\")); const os = __importStar(require(\"os\"))",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-002",
"file": "dist/electron/modules/platform/windows/ax.js",
"line": 44,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/electron/modules/dictation.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/dictation.js:172`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/dictation.js"
},
"evidence": "const resp = await fetch('https://api.superbased.app/api/v1/ai/dictation-stt-config', { headers: { 'Aut",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/electron/modules/dictation.js",
"line": 172,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/headless/electron/modules/dictation.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/headless/electron/modules/dictation.js:172`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/electron/modules/dictation.js"
},
"evidence": "const resp = await fetch('https://api.superbased.app/api/v1/ai/dictation-stt-config', { headers: { 'Aut",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/headless/electron/modules/dictation.js",
"line": 172,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-003",
"title": "Hardcoded egress to an external endpoint (dist/headless/headless/dictation-hotkey.js)",
"category": "exfiltration",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/headless/headless/dictation-hotkey.js:172`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/headless/dictation-hotkey.js"
},
"evidence": "const resp = await fetch('https://api.superbased.app/api/v1/ai/dictation-stt-config', { headers: { 'Aut",
"owasp": "LLM02:2025 Sensitive Information Disclosure",
"data": {
"rule": "MTC-SRC-003",
"file": "dist/headless/headless/dictation-hotkey.js",
"line": 172,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/electron/main.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/main.js:1973`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/main.js"
},
"evidence": "win') { execSync(`osascript -e 'set the clipboard to POSIX file \"${gifPath}\"'`); }",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/electron/main.js",
"line": 1973,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/electron/modules/context-menu-detect.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/context-menu-detect.js:102`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/context-menu-detect.js"
},
"evidence": "onst out = childProcess.execSync(`powershell -ExecutionPolicy Bypass -File \"${script}\"`, { encoding: 'utf-8', timeout: 5",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/electron/modules/context-menu-detect.js",
"line": 102,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/electron/modules/platform/shared.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/shared.js:128`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/shared.js"
},
"evidence": "out = childProcess.execSync(`powershell -ExecutionPolicy Bypass -File \"${script}\"`, { encoding: 'utf-8', timeout: 5",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/electron/modules/platform/shared.js",
"line": 128,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/electron/modules/platform/windows/session.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/windows/session.js:49`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/windows/session.js"
},
"evidence": "onst out = childProcess.execSync(`powershell -NoProfile -Command \"@(Get-Process -Name '${name}' -ErrorAction SilentlyCon",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/electron/modules/platform/windows/session.js",
"line": 49,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/electron/modules/platform/windows/window.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/platform/windows/window.js:210`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/platform/windows/window.js"
},
"evidence": "onst out = childProcess.execSync(`powershell -ExecutionPolicy Bypass -File \"${script}\" -Hwnd ${nativeId} -State ${state}",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/electron/modules/platform/windows/window.js",
"line": 210,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/electron/modules/window-activate.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/window-activate.js:209`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/window-activate.js"
},
"evidence": "{ childProcess.execSync(`powershell -ExecutionPolicy Bypass -File \"${script}\" -TargetHwnd ${targetHwnd}`, { tim",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/electron/modules/window-activate.js",
"line": 209,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/electron/modules/window-input.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/electron/modules/window-input.js:121`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/window-input.js"
},
"evidence": "{ childProcess.execSync(`powershell -ExecutionPolicy Bypass -File \"${script}\" -Hwnd ${hwnd}`, { timeout: 3000,",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/electron/modules/window-input.js",
"line": 121,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/headless/electron/modules/context-menu-detect.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/headless/electron/modules/context-menu-detect.js:102`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/electron/modules/context-menu-detect.js"
},
"evidence": "onst out = childProcess.execSync(`powershell -ExecutionPolicy Bypass -File \"${script}\"`, { encoding: 'utf-8', timeout: 5",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/headless/electron/modules/context-menu-detect.js",
"line": 102,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/headless/electron/modules/platform/shared.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/headless/electron/modules/platform/shared.js:128`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/electron/modules/platform/shared.js"
},
"evidence": "out = childProcess.execSync(`powershell -ExecutionPolicy Bypass -File \"${script}\"`, { encoding: 'utf-8', timeout: 5",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/headless/electron/modules/platform/shared.js",
"line": 128,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-009",
"title": "Untrusted input concatenated into a command sink (dist/headless/electron/modules/platform/windows/session.js)",
"category": "injection",
"severity": "medium",
"confidence": "strong",
"description": "In the server's implementation (`dist/headless/electron/modules/platform/windows/session.js:49`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/electron/modules/platform/windows/session.js"
},
"evidence": "onst out = childProcess.execSync(`powershell -NoProfile -Command \"@(Get-Process -Name '${name}' -ErrorAction SilentlyCon",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-009",
"file": "dist/headless/electron/modules/platform/windows/session.js",
"line": 49,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/electron/core/config.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/electron/core/config.js:58`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/core/config.js"
},
"evidence": "const pkg = require(p); if (pkg.version) { cachedVersion = pkg.version;",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/electron/core/config.js",
"line": 58,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/electron/modules/api-server.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/electron/modules/api-server.js:2628`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/electron/modules/api-server.js"
},
"evidence": "mod = require(p); break; } }",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/electron/modules/api-server.js",
"line": 2628,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/headless/electron/core/config.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/headless/electron/core/config.js:58`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/electron/core/config.js"
},
"evidence": "const pkg = require(p); if (pkg.version) { cachedVersion = pkg.version;",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/headless/electron/core/config.js",
"line": 58,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/headless/electron/modules/api-server.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/headless/electron/modules/api-server.js:2628`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/electron/modules/api-server.js"
},
"evidence": "mod = require(p); break; } }",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/headless/electron/modules/api-server.js",
"line": 2628,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/headless/headless/cli.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/headless/headless/cli.js:157`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/headless/cli.js"
},
"evidence": "st { startMcpServer } = require(mcpPath); await startMcpServer(47592, process.cwd()); } async function handleAuth(su",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/headless/headless/cli.js",
"line": 157,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/headless/headless/doctor.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/headless/headless/doctor.js:175`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/headless/doctor.js"
},
"evidence": "me) { try { require(name); return { label: `Native module: ${name}`, status: 'green', detail: 'loada",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/headless/headless/doctor.js",
"line": 175,
"nonRuntime": false
}
},
{
"ruleId": "MTC-SRC-005",
"title": "Dynamic module load from a non-literal (dist/headless/headless/tui-bridge.js)",
"category": "permissions",
"severity": "medium",
"confidence": "heuristic",
"description": "In the server's implementation (`dist/headless/headless/tui-bridge.js:75`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
"remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
"location": {
"kind": "server",
"name": "dist/headless/headless/tui-bridge.js"
},
"evidence": ".then(s => __importStar(require(s)))); if (entry === 'settings') await mod.startSettingsTui(); else",
"owasp": "LLM05:2025 Improper Output Handling",
"data": {
"rule": "MTC-SRC-005",
"file": "dist/headless/headless/tui-bridge.js",
"line": 75,
"nonRuntime": false
}
}
],
"toxicFlows": [],
"capabilities": [
{
"tool": "superbased_capture",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_ai",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_ocr",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_gallery",
"tags": [
"untrusted-input"
],
"reasons": {
"untrusted-input": [
"keyword \"browse\""
]
}
},
{
"tool": "superbased_gallery_update",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_settings",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_presets",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_recording",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_sessions",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_export",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_compress_text",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_screenshot",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_capture_image",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_gallery_image",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_diff",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_health",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_redact",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_auth",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_license",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_transcribe",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_ai_usage",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_window_list",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_dictation_history",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_describe_frames",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_narrate",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_baseline",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_dictate",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_tools",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_undo_last",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_project",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_workspace_sync",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_stt_status",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_accessibility_tree",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_annotate",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_clipboard",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_click",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_type",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_hotkey",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_resize_window",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_window_bounds",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_find_title_bar_drag_region",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_window_state",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_display_list",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_find_image",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_capture_template",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_dry_run",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_replay",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_doctor_gui_automation",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_open_url",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_drag_file",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_virtual_desktop",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_tray_click",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_tab_management",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_find_in_page",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_dialog_handle",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_form_fill",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_ax_invoke",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_launch_app",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_drag",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_pixel_color",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_hover",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_context_menu_select",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_scroll",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_ui_dump",
"tags": [
"sensitive-source"
],
"reasons": {
"sensitive-source": [
"keyword \"dump\""
]
}
},
{
"tool": "superbased_scroll_to",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_scroll_capture",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_sequence",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_focus_window",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_mouse_position",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_wait_for",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_wait",
"tags": [],
"reasons": {}
},
{
"tool": "superbased_locate",
"tags": [],
"reasons": {}
}
],
"surfaceDigest": "13b7fa397c030751d7b8d29b0a4d75f4e03841ccc8e417fbd476549ccf098764",
"stats": {
"tools": 72,
"prompts": 0,
"resources": 0,
"findingsBySeverity": {
"critical": 0,
"high": 10,
"medium": 20,
"low": 0,
"info": 0
}
}
}