che-logic-pro-mcp

The server has critical security vulnerabilities. The `logic_screenshot` tool directly interpolates user-provided `save_path` into a `do shell script` command within AppleScript without proper sanitization. This allows for arbitrary shell command injection, meaning a malicious input to `save_path` could execute any command on the user's system (e.g., `save_path: "/tmp/foo.png' && rm -rf /"`). Additionally, while the `logic_shortcut` tool attempts to construct keyboard shortcuts, the `buildModifierClause` function has a `default` case that directly interpolates an unvalidated modifier string, which could lead to AppleScript injection attempts if crafted maliciously (though it's more likely to cause syntax errors here). The underlying `NSAppleScript(source:)` and `do shell script` mechanisms are inherently dangerous when inputs are not rigorously sanitized.