dynamic-shell-server

The server's `execute_command` tool defaults to `shell=True` for `asyncio.create_subprocess_shell`, and `run_in_venv` explicitly uses `/bin/bash -c`. This directly contradicts the README's claim of 'No shell execution (prevents injection attacks)'. Furthermore, the advertised '5-minute command timeout' is not implemented in `run_process_in_background`, which uses `process.communicate()` without a timeout, allowing commands to run indefinitely. While an external approval system is described, the server code itself enables highly privileged shell execution without internal safeguards against common vulnerabilities like command injection or hanging processes. The reliance on an external, unspecified approval system for security is a significant concern given the server's direct capabilities.