Pagecast
Records browser sessions as GIFs, WebM, and MP4 videos for demos and documentation.
0Tools
9Findings
3Stars
Mar 22, 2026Last Scanned
2 critical · 4 high · 2 medium · 1 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output
Findings9
2critical
4high
2medium
1low
Critical2
criticalC1Command InjectionMCP03-command-injectionAML.T0054
Pattern "`[^`]+`" matched in source_code: "`Open a URL in a browser and start recording video. Returns a session ID. Call stop_recording when done.
Instead of specifying width/height, you can use the "platform" parameter:
- "Record my app for GitHub README" → platform: "github" (1280×720, GIF)
- "Record my app for Instagram Reels" → platform: "reels" (1080×1920, MP4)
- "Record my app for TikTok" → platform: "tiktok" (1080×1920, MP4)
- "Record my app for YouTube" → platform: "youtube" (1280×720, MP4)
- "Record my app for YouTube Shorts" → platform: "shorts" (1080×1920, MP4)
- "Record my app for Instagram post" → platform: "instagram" (1080×1080, MP4)
- "Record my app for LinkedIn" → platform: "linkedin" (1080×1080, MP4)
- "Record my app for Twitter" → platform: "twitter" (1280×720, MP4)
Or pass custom width/height for any other size.`" (at position 2076)
Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.
criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054
Pattern "["']@modelcontextprotocol/sdk["']\s*:\s*["'](?:\^|~|\*|latest)" matched in source_code: ""@modelcontextprotocol/sdk": "^" (at position 13393)
MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.
High4
highO6Server Fingerprinting via Error ResponsesMCP04-data-exfiltrationAML.T0057
Pattern "catch\s*\([^)]*\)\s*\{[^}]*(?:res\.(?:send|json)|return).*(?:err(?:or)?\.(?:message|stack|code)|connection|host|port|database)" matched in source_code: "catch (err) {
return { content: [{ type: 'text', text: `Error: ${err.message" (at position 4219)
Never expose process, OS, runtime, or database metadata in tool responses or error messages. Use generic error messages ("An error occurred") for production responses. Remove or disable debug/diagnostic endpoints. If health endpoints are needed, limit them to simple "ok"/"error" status without infrastructure details. Wrap all error handlers with a sanitization layer that strips system information.
highO8Timing-Based Covert ChannelMCP04-data-exfiltrationAML.T0057
Pattern "(?:delay|sleep|timeout|interval)\s*[:=]\s*(?:[^;]*(?:secret|token|password|credential|key|env))" matched in source_code: "delay: z.number().optional().describe('Typing delay between characters in ms (for type action, default 80)'),
key: z.string().optional().describe('Key" (at position 5341)
Remove all code that calculates sleep/delay durations from application data, secrets, or any variable-length content. Tool response times should be constant or determined only by legitimate processing time. If rate limiting is needed, use fixed intervals not derived from data values. Monitor for anomalous response time patterns that could indicate timing-based exfiltration.
highK13Unsanitized Tool OutputMCP02-tool-poisoningAML.T0054
Pattern "(?:readFile|read_file|open).*(?:return|respond|result|content|text)(?!.*(?:sanitize|escape|encode|strip|filter|validate|truncate))" matched in source_code: "Open a URL in a browser and start recording video. Return" (at position 2077)
Sanitize all external data before including in tool responses. Implement output encoding that neutralizes prompt injection patterns. Truncate excessively long content. Validate structure before passing database results. Apply the principle: treat all external data as untrusted, even in tool outputs. Required by CoSAI MCP-T4.
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "playwright@1.52.0" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
Medium2
mediumK17Missing Timeout or Circuit BreakerMCP07-insecure-configAML.T0054
Pattern "(?:query|execute|find|select|aggregate)\s*\((?!.*(?:timeout|maxTimeMS|statement_timeout|deadline|cancel))" matched in source_code: "select (" (at position 5634)
Add timeouts to ALL external calls: HTTP requests (30s), database queries (10s), subprocess execution (60s), and MCP tool calls (30s). Implement circuit breakers that open after N consecutive failures (e.g., opossum, cockatiel). Use AbortSignal for cancellable operations. Required by EU AI Act Art. 15 and OWASP ASI08.
mediumC6Error LeakageMCP09-logging-monitoring
Pattern "catch\s*\([^)]*\)\s*\{[^}]*(?:throw|return).*(?:err|error)\.(?:message|stack)" matched in source_code: "catch (err) {
return { content: [{ type: 'text', text: `Error: ${err.message" (at position 4219)
Return generic error messages to clients. Log detailed errors server-side. Never expose stack traces, file paths, or internal error details in responses.
Low1
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.