ericmjl-productivity-mcp

The server uses prompts that instruct the LLM to generate and execute shell commands (e.g., `git checkout -b <branch-name>`) and perform file system operations (e.g., creating/updating Obsidian notes based on `topic` or `note_name`). There is no explicit sanitization of LLM-generated strings before they are used in these contexts. This creates a significant risk of command injection (if a malicious branch name is generated) or path traversal (if a malicious note name/topic is generated), potentially allowing the LLM to execute arbitrary commands or write files to unintended locations. Additionally, the `upgrade_repo_to_template` prompt instructs cloning external repositories, which carries a supply chain risk, even though the current URL is benign. While the LLM is instructed with rules, these are not programmatic safeguards.