get_config

1 finding on this tool

1. criticalexcessive agencyf-r7-get_config

   Tool `get_config` exposes a code/command execution surface

   `get_config` looks like it executes code or shell commands ( Get the complete server configuration as JSON. Config includes fields for: - blockedCommands (array of blocked shell commands) - defaultShell (shell to use for commands) - allowedDirectories (paths the server can access) - fileReadLineLimit (max lines for read_file, default 1000) - fileWriteLineLimit (max lines per write_file call, default 50) - telemetryEnabled (boolean for telemetry opt-in/out) - currentClient (information about the currently connected MCP client) - clientHistory (history of all clients that have connected) - version (version of the DesktopCommander) - systemInfo (operating system and environment details) This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051