registry / @legdev/tkxr / 1.1.16

@legdev/tkxr@1.1.16

In-repo ticket management system with CLI and web interface

AI Security Review

scanned 9h ago · by lpm-firewall-ai

An explicitly started MCP server exposes shell command injection through tool arguments. No install-time execution or confirmed exfiltration is present.

Static reason

No blocking static signals were detected.

Trigger

User or AI client starts `tkxr mcp` and sends a crafted MCP tool argument.

Impact

Arbitrary OS command execution as the user running the MCP server, with access to that working directory.

Mechanism

Unsafely interpolated MCP arguments passed to `child_process.exec`.

Rationale

The package is not malicious at install time, but its MCP bridge contains a concrete shell-injection RCE reachable through crafted tool input. Warn rather than block because activation requires explicit user-run MCP setup and no stealth, exfiltration, or lifecycle abuse was found.

Evidence

package.jsondist/mcp/server.jsdist/cli/index.jsdist/core/notifier.jsdist/cli/commands/serve.js

Decision evidence

public snapshot

AI called this Suspicious at 96.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`dist/mcp/server.js` builds a shell command from MCP arguments and calls `child_process.exec`.

@legdev/tkxr@1.1.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code