Yawlabs Ssh MCP Server

This server (without client built-ins) exposes a complete data-exfiltration chain: ssh_download → ssh_ls → ssh_exec. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.

Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.

Location: flow ssh_download → ssh_ls → ssh_exec

In the server's implementation (`dist/index.js:97`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } const keyTypes = ["id_ed25519", "id_rsa", "id_ecdsa"]; const found = []; for (const key of keyTypes) { cons

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/server.js:96`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: } const keyTypes = ["id_ed25519", "id_rsa", "id_ecdsa"]; const found = []; for (const key of keyTypes) { cons

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server.js

Tool "ssh_exec" appears to run shell commands or evaluate code (keyword "exec" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool ssh_exec

Tool "ssh_multi_exec" appears to run shell commands or evaluate code (keyword "exec" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.

Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.

Location: tool ssh_multi_exec

In the server's implementation (`bin/ssh-mcp.mjs:49`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ync, spawn } from "node:child_process"; import { existsSync } from "node:fs"; import { constants, homedir } from "node:o

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/ssh-mcp.mjs

In the server's implementation (`dist/index.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s execFileSync2 } from "child_process"; import { appendFileSync, existsSync as existsSync2, readdirSync as readdirSync2,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/index.js

In the server's implementation (`dist/server.js:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from "child_process"; import { existsSync, readdirSync, readFileSync } from "fs"; import { homedir } f

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/server.js

Tool "ssh_write_file" can write, overwrite or delete files (keyword "write_file" in tool name). Verify it is scoped to a safe directory.

Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.

Location: tool ssh_write_file

In the server's implementation (`bin/ssh-mcp.mjs:201`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: = SERVER_ENTRY; await import(SERVER_URL.href); } const mode = (process.env.SSH_MCP_RUNTIME ?? "auto").toLowerCase();

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server bin/ssh-mcp.mjs

Tool "ssh_exec" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool ssh_exec

Tool "ssh_write_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool ssh_write_file

Tool "ssh_multi_exec" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.

Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.

Location: tool ssh_multi_exec

Shell command embedded in tool metadata detected in the description of tool "ssh_delete". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.

Evidence: rm -rf

Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.

Location: tool ssh_delete · description

Reference to a credential-exfiltration path in metadata detected in the description of tool "ssh_key_list". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.

Evidence: ~/.ssh

Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.

Location: tool ssh_key_list · description

Reference to a credential-exfiltration path in metadata detected in the description of tool "ssh_config_lookup". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.

Evidence: ~/.ssh

Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.

Location: tool ssh_config_lookup · description