android-wifi-mcp

The server executes ADB shell commands directly based on user-provided input for tools like `network_ping` and `network_dns_lookup`. This pattern is vulnerable to shell injection if the 'host' or 'hostname' parameters are crafted to include shell metacharacters (e.g., '8.8.8.8; rm -rf /'). While `wifi_connect` attempts to quote SSID and password, it's still susceptible to sophisticated injection attacks. The `enterprise-wifi.ts` component uses a more robust quoting mechanism for JSON payloads written to device files, but this best practice is not universally applied across all shell command constructions. Running this server implies a high level of trust in both the client (e.g., Claude agent) and the execution environment, as a malicious client could exploit these vulnerabilities to execute arbitrary commands on the connected Android device.