chatgpt-handoff-mcp

The server uses `exec.Command` for cross-platform clipboard operations. While the prompt content is generally passed via stdin to `pbcopy`, `xclip`, or `xsel`, and securely via a PowerShell here-string on Windows, this pattern always carries a theoretical, albeit low, risk of command injection or unforeseen interpretation of special characters by the external utilities if the input is malicious. However, no 'eval' or direct command-line argument injection using user input was found. There are no hardcoded secrets, and network exposure is limited to a local HTTP server if enabled.