Desktop Commander MCP

All 29 findings

1. critical
   Tool `get_config` exposes a code/command execution surface· get_configexcessive agency

   `get_config` looks like it executes code or shell commands ( Get the complete server configuration as JSON. Config includes fields for: - blockedCommands (array of blocked shell commands) - defaultShell (shell to use for commands) - allowedDirectories (paths the server can access) - fileReadLineLimit (max lines for read_file, default 1000) - fileWriteLineLimit (max lines per write_file call, default 50) - telemetryEnabled (boolean for telemetry opt-in/out) - currentClient (information about the currently connected MCP client) - clientHistory (history of all clients that have connected) - version (version of the DesktopCommander) - systemInfo (operating system and environment details) This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

2. critical
   Tool `read_file` exposes a code/command execution surface· read_fileexcessive agency

   `read_file` looks like it executes code or shell commands ( Read contents from files and URLs. Read PDF files and extract content as markdown and images. Prefer this over 'execute_command' with cat/type for viewing files. Supports partial file reading with: - 'offset' (start line, default: 0) * Positive: Start from line N (0-based indexing) * Negative: Read last N lines from end (tail behavior) - 'length' (max lines to read, default: configurable via 'fileReadLineLimit' setting, initially 1000) * Used with positive offsets for range reading * Ignored when offset is negative (reads all requested tail lines) Examples: - offset: 0, length: 10 → First 10 lines - offset: 100, length: 5 → Lines 100-104 - offset: -20 → Last 20 lines - offset: -5, length: 10 → Last 5 lines (length ignored) Performance optimizations: - Large files with negative offsets use reverse reading for efficiency - Large files with deep positive offsets use byte estimation - Small files use fast readline streaming When reading from the file system, only works within allowed directories. Can fetch content from URLs when isUrl parameter is set to true (URLs are always read in full regardless of offset/length). FORMAT HANDLING (by extension): - Text: Uses offset/length for line-based pagination - Excel (.xlsx, .xls, .xlsm): Returns JSON 2D array * sheet: "Sheet1" (name) or "0" (index as string, 0-based) * range: ALWAYS use FROM:TO format (e.g., "A1:D100", "C1:C1", "B2:B50") * offset/length work as row pagination (optional fallback) - Images (PNG, JPEG, GIF, WebP): Base64 encoded viewable content - PDF: Extracts text content as markdown with page structure * offset/length work as page pagination (0-based) * Includes embedded images when available - DOCX (.docx): Two modes depending on parameters: * DEFAULT (no offset/length): Returns a text-bearing outline — shows paragraphs with text, tables with cell content, styles, image refs. Skips shapes/drawings/SVG noise. Each element shows its body index [0], [1], etc. * WITH offset/length: Returns raw pretty-printed XML with line pagination. Use this to drill into specific sections or see the actual XML for editing. * EDITING WORKFLOW: 1) read_file to get outline, 2) read_file with offset/length to see raw XML around what you want to edit, 3) edit_block with old_string/new_string using XML fragments copied from the read output. * IMPORTANT: offset MUST be non-zero to get raw XML (use offset=1 to start from line 1). offset=0 always returns the outline regardless of length. * For BULK changes (translation, mass replacements): use start_process with Python zipfile module to find/replace all <w:t> elements at once. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

3. critical
   Tool `list_directory` exposes a code/command execution surface· list_directoryexcessive agency

   `list_directory` looks like it executes code or shell commands ( Get a detailed listing of all files and directories in a specified path. Use this instead of 'execute_command' with ls/dir commands. Results distinguish between files and directories with [FILE] and [DIR] prefixes. Supports recursive listing with the 'depth' parameter (default: 2): - depth=1: Only direct contents of the directory - depth=2: Contents plus one level of subdirectories - depth=3+: Multiple levels deep CONTEXT OVERFLOW PROTECTION: - Top-level directory shows ALL items - Nested directories are limited to 100 items maximum per directory - When a nested directory has more than 100 items, you'll see a warning like: [WARNING] node_modules: 500 items hidden (showing first 100 of 600 total) - This prevents overwhelming the context with large directories like node_modules Results show full relative paths from the root directory being listed. Example output with depth=2: [DIR] src [FILE] src/index.ts [DIR] src/tools [FILE] src/tools/filesystem.ts If a directory cannot be accessed, it will show [DENIED] instead. If a path does not exist, it will show [NOT_FOUND] instead. Only works within allowed directories. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

4. critical
   Tool `get_prompts` exposes a code/command execution surface· get_promptsexcessive agency

   `get_prompts` looks like it executes code or shell commands ( Retrieve a specific Desktop Commander onboarding prompt by ID and execute it. SIMPLIFIED ONBOARDING V2: This tool only supports direct prompt retrieval. The onboarding system presents 5 options as a simple numbered list: 1. Organize my Downloads folder (promptId: 'onb2_01') 2. Explain a codebase or repository (promptId: 'onb2_02') 3. Create organized knowledge base (promptId: 'onb2_03') 4. Analyze a data file (promptId: 'onb2_04') 5. Check system health and resources (promptId: 'onb2_05') USAGE: When user says "1", "2", "3", "4", or "5" from onboarding: - "1" → get_prompts(action='get_prompt', promptId='onb2_01') - "2" → get_prompts(action='get_prompt', promptId='onb2_02') - "3" → get_prompts(action='get_prompt', promptId='onb2_03') - "4" → get_prompts(action='get_prompt', promptId='onb2_04') - "5" → get_prompts(action='get_prompt', promptId='onb2_05') The prompt content will be injected and execution begins immediately. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

5. high
   Tool `get_config` writes to or deletes from the host filesystem· get_configfilesystem egress

   `get_config` appears to write, create, move, or delete files on the host filesystem ( Get the complete server configuration as JSON. Config includes fields for: - blockedCommands (array of blocked shell commands) - defaultShell (shell to use for commands) - allowedDirectories (paths the server can access) - fileReadLineLimit (max lines for read_file, default 1000) - fileWriteLineLimit (max lines per write_file call, default 50) - telemetryEnabled (boolean for telemetry opt-in/out) - currentClient (information about the currently connected MCP client) - clientHistory (history of all clients that have connected) - version (version of the DesktopCommander) - systemInfo (operating system and environment details) This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

   fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

6. high
   Tool `set_config_value` name implies a side effect that is not declared· set_config_valueexcessive agency

   `set_config_value` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

7. high
   Tool `set_config_value` writes to or deletes from the host filesystem· set_config_valuefilesystem egress

   `set_config_value` appears to write, create, move, or delete files on the host filesystem ( Set a specific configuration value by key. WARNING: Should be used in a separate chat from file operations and command execution to prevent security issues. Config keys include: - blockedCommands (array) - defaultShell (string) - allowedDirectories (array of paths) - fileReadLineLimit (number, max lines for read_file) - fileWriteLineLimit (number, max lines per write_file call) - telemetryEnabled (boolean) IMPORTANT: Setting allowedDirectories to an empty array ([]) allows full access to the entire file system, regardless of the operating system. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

   fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

8. high
   Tool `write_file` name implies a side effect that is not declared· write_fileexcessive agency

   `write_file` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

9. high
   Tool `write_file` writes to or deletes from the host filesystem· write_filefilesystem egress

   `write_file` appears to write, create, move, or delete files on the host filesystem ( Write or append to file contents. IMPORTANT: DO NOT use this tool to create PDF files. Use 'write_pdf' for all PDF creation tasks. DO NOT use this tool to edit DOCX files. Use 'edit_block' with old_string/new_string instead. To CREATE a new DOCX, use write_file with .docx extension — text content with markdown headings (#, ##, ###) is converted to styled DOCX paragraphs. CHUNKING IS STANDARD PRACTICE: Always write files in chunks of 25-30 lines maximum. This is the normal, recommended way to write files - not an emergency measure. STANDARD PROCESS FOR ANY FILE: 1. FIRST → write_file(filePath, firstChunk, {mode: 'rewrite'}) [≤30 lines] 2. THEN → write_file(filePath, secondChunk, {mode: 'append'}) [≤30 lines] 3. CONTINUE → write_file(filePath, nextChunk, {mode: 'append'}) [≤30 lines] ALWAYS CHUNK PROACTIVELY - don't wait for performance warnings! WHEN TO CHUNK (always be proactive): 1. Any file expected to be longer than 25-30 lines 2. When writing multiple files in sequence 3. When creating documentation, code files, or configuration files HANDLING CONTINUATION ("Continue" prompts): If user asks to "Continue" after an incomplete operation: 1. Read the file to see what was successfully written 2. Continue writing ONLY the remaining content using {mode: 'append'} 3. Keep chunks to 25-30 lines each FORMAT HANDLING (by extension): - Text files: String content - Excel (.xlsx, .xls, .xlsm): JSON 2D array or {"SheetName": [[...]]} Example: '[["Name","Age"],["Alice",30]]' Files over 50 lines will generate performance notes but are still written successfully. Only works within allowed directories. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

   fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

10. high
    Tool `write_pdf` name implies a side effect that is not declared· write_pdfexcessive agency

    `write_pdf` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

    fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

11. high
    Tool `write_pdf` writes to or deletes from the host filesystem· write_pdffilesystem egress

    `write_pdf` appears to write, create, move, or delete files on the host filesystem ( Create a new PDF file or modify an existing one. THIS IS THE ONLY TOOL FOR CREATING AND MODIFYING PDF FILES. RULES ABOUT FILENAMES: - When creating a new PDF, 'outputPath' MUST be provided and MUST use a new unique filename (e.g., "result_01.pdf", "analysis_2025_01.pdf", etc.). MODES: 1. CREATE NEW PDF: - Pass a markdown string as 'content'. write_pdf(path="doc.pdf", content="# Title\n\nBody text...") 2. MODIFY EXISTING PDF: - Pass array of operations as 'content'. - NEVER overwrite the original file. - ALWAYS provide a new filename in 'outputPath'. - After modifying, show original file path and new file path to user. write_pdf(path="doc.pdf", content=[ { type: "delete", pageIndexes: [0, 2] }, { type: "insert", pageIndex: 1, markdown: "# New Page" } ]) OPERATIONS: - delete: Remove pages by 0-based index. { type: "delete", pageIndexes: [0, 1, 5] } - insert: Add pages at a specific 0-based index. { type: "insert", pageIndex: 0, markdown: "..." } { type: "insert", pageIndex: 5, sourcePdfPath: "/path/to/source.pdf" } PAGE BREAKS: To force a page break, use this HTML element: <div style="page-break-before: always;"></div> Example: "# Page 1\n\n<div style=\"page-break-before: always;\"></div>\n\n# Page 2" ADVANCED STYLING: HTML/CSS and inline SVG are supported for: - Text styling: colors, sizes, alignment, highlights - Boxes: borders, backgrounds, padding, rounded corners - SVG graphics: charts, diagrams, icons, shapes - Images: <img src="/absolute/path/image.jpg" width="300" /> or  Supports standard markdown features including headers, lists, code blocks, tables, and basic formatting. Only works within allowed directories. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

    fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

12. high
    Tool `create_directory` name implies a side effect that is not declared· create_directoryexcessive agency

    `create_directory` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

    fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

13. high
    Tool `move_file` writes to or deletes from the host filesystem· move_filefilesystem egress

    `move_file` appears to write, create, move, or delete files on the host filesystem ( Move or rename files and directories. Can move files between directories and rename them in a single operation. Both source and destination must be within allowed directories. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

    fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

14. high
    Tool `start_search` exposes secrets or credentials to the agent· start_searchsecret exposure

    `start_search` appears to read or return secrets, API keys, credentials, or environment variables ( Start a streaming search that can return results progressively. SEARCH STRATEGY GUIDE: Choose the right search type based on what the user is looking for: USE searchType="files" WHEN: - User asks for specific files: "find package.json", "locate config files" - Pattern looks like a filename: "*.js", "README.md", "test-*.tsx" - User wants to find files by name/extension: "all TypeScript files", "Python scripts" - Looking for configuration/setup files: ".env", "dockerfile", "tsconfig.json" USE searchType="content" WHEN: - User asks about code/logic: "authentication logic", "error handling", "API calls" - Looking for functions/variables: "getUserData function", "useState hook" - Searching for text/comments: "TODO items", "FIXME comments", "documentation" - Finding patterns in code: "console.log statements", "import statements" - User describes functionality: "components that handle login", "files with database queries" WHEN UNSURE OR USER REQUEST IS AMBIGUOUS: Run TWO searches in parallel - one for files and one for content: Example approach for ambiguous queries like "find authentication stuff": 1. Start file search: searchType="files", pattern="auth" 2. Simultaneously start content search: searchType="content", pattern="authentication" 3. Present combined results: "Found 3 auth-related files and 8 files containing authentication code" SEARCH TYPES: - searchType="files": Find files by name (pattern matches file names) - searchType="content": Search inside files for text patterns PATTERN MATCHING MODES: - Default (literalSearch=false): Patterns are treated as regular expressions - Literal (literalSearch=true): Patterns are treated as exact strings WHEN TO USE literalSearch=true: Use literal search when searching for code patterns with special characters: - Function calls with parentheses and quotes - Array access with brackets - Object methods with dots and parentheses - File paths with backslashes - Any pattern containing: . * + ? ^ $ { } [ ] | \ ( ) IMPORTANT PARAMETERS: - pattern: What to search for (file names OR content text) - literalSearch: Use exact string matching instead of regex (default: false) - filePattern: Optional filter to limit search to specific file types (e.g., "*.js", "package.json") - ignoreCase: Case-insensitive search (default: true). Works for both file names and content. - earlyTermination: Stop search early when exact filename match is found (optional: defaults to true for file searches, false for content searches) DECISION EXAMPLES: - "find package.json" → searchType="files", pattern="package.json" (specific file) - "find authentication components" → searchType="content", pattern="authentication" (looking for functionality) - "locate all React components" → searchType="files", pattern="*.tsx" or "*.jsx" (file pattern) - "find TODO comments" → searchType="content", pattern="TODO" (text in files) - "show me login files" → AMBIGUOUS → run both: files with "login" AND content with "login" - "find config" → AMBIGUOUS → run both: config files AND files containing config code COMPREHENSIVE SEARCH EXAMPLES: - Find package.json files: searchType="files", pattern="package.json" - Find all JS files: searchType="files", pattern="*.js" - Search for TODO in code: searchType="content", pattern="TODO", filePattern="*.js|*.ts" - Search for exact code: searchType="content", pattern="toast.error('test')", literalSearch=true - Ambiguous request "find auth stuff": Run two searches: 1. searchType="files", pattern="auth" 2. searchType="content", pattern="authentication" PRO TIP: When user requests are ambiguous about whether they want files or content, run both searches concurrently and combine results for comprehensive coverage. Unlike regular search tools, this starts a background search process and returns immediately with a session ID. Use get_more_search_results to get results as they come in, and stop_search to stop the search early if needed. Perfect for large directories where you want to see results immediately and have the option to cancel if the search takes too long or you find what you need. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). Values surfaced in the model context are visible to any prompt with injection access; a compromised agent can relay them to an attacker-controlled server.

    fix: Do not expose secrets to the agent: inject them server-side at call time rather than passing them through the model context. If a tool must return a credential, scope it with a capframe-bind time-limited caveat and log every issuance.

15. high
    Tool `edit_block` name implies a side effect that is not declared· edit_blockexcessive agency

    `edit_block` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

    fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

16. high
    Tool `edit_block` writes to or deletes from the host filesystem· edit_blockfilesystem egress

    `edit_block` appears to write, create, move, or delete files on the host filesystem ( Apply surgical edits to files. BEST PRACTICE: Make multiple small, focused edits rather than one large edit. Each edit_block call should change only what needs to be changed - include just enough context to uniquely identify the text being modified. FORMAT HANDLING (by extension): EXCEL FILES (.xlsx, .xls, .xlsm) - Range Update mode: Takes: - file_path: Path to the Excel file - range: ALWAYS use FROM:TO format - "SheetName!A1:C10" or "SheetName!C1:C1" - content: 2D array, e.g., [["H1","H2"],["R1","R2"]] TEXT FILES - Find/Replace mode: Takes: - file_path: Path to the file to edit - old_string: Text to replace - new_string: Replacement text - expected_replacements: Optional number of replacements (default: 1) DOCX FILES (.docx) - XML Find/Replace mode: Takes same parameters as text files (old_string, new_string, expected_replacements). Operates on the pretty-printed XML inside the DOCX — the same XML you see from read_file with offset/length. Copy XML fragments from read output as old_string. After editing, the XML is repacked into a valid DOCX. Also searches headers/footers if not found in document body. Examples: - Replace text: old_string="<w:t>Old Text</w:t>" new_string="<w:t>New Text</w:t>" - Change style: old_string='<w:pStyle w:val="Normal"/>' new_string='<w:pStyle w:val="Heading1"/>' - Add content: include surrounding XML context in old_string, add new elements in new_string By default, replaces only ONE occurrence of the search text. To replace multiple occurrences, provide expected_replacements with the exact number of matches expected. UNIQUENESS REQUIREMENT: When expected_replacements=1 (default), include the minimal amount of context necessary (typically 1-3 lines) before and after the change point, with exact whitespace and indentation. When editing multiple sections, make separate edit_block calls for each distinct change rather than one large replacement. When a close but non-exact match is found, a character-level diff is shown in the format: common_prefix{-removed-}{+added+}common_suffix to help you identify what's different. Similar to write_file, there is a configurable line limit (fileWriteLineLimit) that warns if the edited file exceeds this limit. If this happens, consider breaking your edits into smaller, more focused changes. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

    fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

17. medium
    Tool `read_file` accepts unconstrained string input· read_fileunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `path`, `range`, `sheet`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

18. medium
    Tool `write_file` accepts unconstrained string input· write_fileunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `content`, `path`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

19. medium
    Tool `create_directory` accepts unconstrained string input· create_directoryunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `path`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

20. medium
    Tool `list_directory` accepts unconstrained string input· list_directoryunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `path`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

21. medium
    Tool `move_file` accepts unconstrained string input· move_fileunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `destination`, `source`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

22. medium
    Tool `start_search` accepts unconstrained string input· start_searchunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `filePattern`, `path`, `pattern`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

23. medium
    Tool `get_more_search_results` accepts unconstrained string input· get_more_search_resultsunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `sessionId`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

24. medium
    Tool `stop_search` accepts unconstrained string input· stop_searchunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `sessionId`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

25. medium
    Tool `get_file_info` accepts unconstrained string input· get_file_infounconstrained input

    The following string parameter(s) have no `maxLength` constraint: `path`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

26. medium
    Tool `start_process` accepts unconstrained string input· start_processunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `command`, `shell`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

27. medium
    Tool `interact_with_process` accepts unconstrained string input· interact_with_processunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `input`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

28. medium
    Tool `get_recent_tool_calls` accepts unconstrained string input· get_recent_tool_callsunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `since`, `toolName`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

29. medium
    Tool `get_prompts` accepts unconstrained string input· get_promptsunconstrained input

    The following string parameter(s) have no `maxLength` constraint: `promptId`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

    fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.