imprint

The `imprint` server executes shell commands via `exec.Command` in its `internal/terminal/terminal.go` component, specifically using `sh -c {shell}` for the `t.shell` variable. This `t.shell` originates from the `--shell` command-line argument and the `command` parameter of the `restart_terminal` MCP tool. If a malicious AI agent or a compromised orchestrator provides a crafted `command` (e.g., containing `; rm -rf /`), it can lead to arbitrary command injection on the host system. The `install.sh` script also requires `sudo` privileges for package manager installations, which is a point of privilege escalation during installation. Network exposure for `ttyd` is limited as it binds to `127.0.0.1`, reducing direct remote attack vectors. Use of `page.Eval` is contained within a sandboxed headless browser context for known `xterm.js` APIs, posing a lower risk.