wechat-robot-mcp-server

CRITICAL vulnerability identified: The `buildDSNForRobot` function constructs a MySQL DSN using `robotCode` directly as the database name. If `robotCode` can be controlled or influenced by an attacker, this allows for database name injection, potentially enabling access to arbitrary databases on the MySQL server or causing denial of service by repeatedly attempting to connect to non-existent databases. Additionally, the server makes external HTTP requests to various AI service providers (e.g., OpenAI, Doubao, Jimeng, GLM, Hunyuan) and a music API (`api.cenguigui.cn`). While parameters are typically encoded, the reliability and security of these third-party services are external dependencies. AI API keys and other sensitive settings are stored in the database, requiring robust database security. No 'eval' or obvious obfuscation detected.