mobiledevice-mcp-zed-extension

The server uses `adb_client` and `xcrun simctl` for device control, which inherently involves executing shell commands. While arguments are generally passed as separate strings to `Command::new`, minimizing direct shell injection, the `send_keys` function in `src/devices/android.rs` performs manual string escaping for `input text` commands. Manual escaping is error-prone and could potentially lead to vulnerabilities if not perfectly robust against all possible inputs. The use of an unspecified `com.mobilenext.devicekit` for non-ASCII text on Android also introduces an un-audited component. No hardcoded secrets or obvious malicious patterns were found. The server primarily communicates via stdin/stdout and local ADB/USB connections.