screen2claude

The server's core screenshot capture mechanism (PowerShell -EncodedCommand) helps mitigate command injection risks from the script content itself. No obvious direct code injection vulnerabilities from user input were found. However, the SSE server in `sse-server.ts` uses `Access-Control-Allow-Origin: *`, which is a permissive CORS policy, potentially allowing any origin to connect, though MCP SDK handles the protocol. Configuration files (`config.json`) should be secured as they can contain sensitive `auth_token`s. The `save_screenshots` feature writes to a configurable directory, which if misconfigured, could lead to unintended file writes.