filopastry

Critical vulnerability: The `write` tool directly writes user-provided pattern code (which is JavaScript) to the Strudel.cc editor in the browser without enforcing validation. Although a `PatternValidator` exists to check for 'eval()' and other dangerous functions, it is not utilized by default when using the `write` tool, allowing arbitrary code execution within the browser context. This poses a severe risk if a malicious client or compromised AI provides harmful code. The `executeInStrudelContext` method also uses `eval()` internally but is not exposed as a direct MCP tool. Hardcoded API keys are avoided by relying on environment variables, which is a good practice.