Webhook (zebbern) MCP Server

In the server's implementation (`services/bugbounty_service.py:260`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s["base64"] = f'<script>eval(atob("{self._base64_encode(encoded_fetch)}"))</script>' payloads["unicode"] = self.

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server services/bugbounty_service.py

In the server's implementation (`evals/run_evals.py:75`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: del", model] proc = subprocess.run(cmd, cwd=ROOT, capture_output=True, text=True, encoding="utf-8", errors="replace"

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server evals/run_evals.py

Untrusted-input tools ([download_request_file]) co-exist with external-action tools ([create_webhook, configure_webhook, delete_webhook, export_webhook_data]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.

Evidence: untrusted [download_request_file] → sinks [create_webhook, configure_webhook, delete_webhook, export_webhook_data]

Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.

Location: flow download_request_file → create_webhook