polar
One-click Bitcoin Lightning networks for local app development & testing
0Tools
4Findings
854Stars
Mar 22, 2026Last Scanned
1 critical · 1 high · 2 low findings detected
Security Category Deep Dive
Prompt Injection
Prompt & context manipulation attacks
69
Maturity
14
Rules
5
Sub-Categories
1
Gaps
64%
Implemented
56
Tests
1
Stories
100%3 rules
Injection via tool descriptions and parameter fields
GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules
100%4 rules
Hidden instructions via external content and tool responses
100%2 rules
Context window saturation and prior-approval exploitation
100%3 rules
Payload hiding via invisible chars, base64, schema fields
100%2 rules
Injection via prompt templates and runtime tool output
Findings4
1critical
1high
2low
Critical1
criticalJ2Git Argument InjectionMCP03-command-injectionAML.T0054
Pattern "--upload-pack|--receive-pack|--exec" matched in source_code: "--exec" (at position 838)
Always terminate git argument lists with '--' before user-supplied paths. Never allow git_init on directories outside the configured workspace. Validate all git arguments against an allowlist. Block core.* config overrides in user-controlled inputs. See CVE-2025-68143/68144/68145 for the full attack chain.
High1
highD1Known CVEs in DependenciesMCP08-dependency-vuln
Dependency "electron@13.6.3" has known CVEs:
Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.
Low2
lowD4Excessive Dependency CountMCP08-dependency-vuln
Server has 112 dependencies (threshold: 50)
Reduce the number of direct dependencies. Each dependency increases the attack surface. Consider whether lighter alternatives exist.
lowF4MCP Spec Non-ComplianceMCP07-insecure-config
Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions
Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.