ZwickRoell Testing Analytics

Analyzes material testing data from ZwickRoell testing machines.

dev-tools

GitHub

0Tools

15Findings

0Stars

Mar 24, 2026Last Scanned

⚠2 critical · 11 high · 1 medium · 1 low findings detected

Security Category Deep Dive

⚡

Prompt Injection

Prompt & context manipulation attacks

Maturity

Rules

Sub-Categories

Gaps

64%

Implemented

Tests

Stories

PI-DIRDirect Input Injection

100%3 rules

Injection via tool descriptions and parameter fields

GAP-001Prompt Injection Coverage GapMissing detection coverage for emerging prompt injection attack variants not addressed by current rules

PI-INDIndirect / Gateway Injection

100%4 rules

Hidden instructions via external content and tool responses

PI-CTXContext Manipulation

100%2 rules

Context window saturation and prior-approval exploitation

PI-ENCEncoding & Obfuscation

100%3 rules

Payload hiding via invisible chars, base64, schema fields

PI-TPLTemplate & Output Poisoning

50%2 rules1 found

Injection via prompt templates and runtime tool output

Findings15

2critical

11high

1medium

1low

Critical2

criticalQ13MCP Bridge Package Supply Chain AttackMCP10-supply-chainAML.T0054

Pattern "["']@modelcontextprotocol/sdk["']\s*:\s*["'](?:\^|~|\*|latest)" matched in source_code: ""@modelcontextprotocol/sdk": "^" (at position 11636)

MCP bridge packages (mcp-remote, mcp-proxy, @modelcontextprotocol/sdk, fastmcp) are high-value supply chain targets — CVE-2025-6514 (CVSS 9.6) in mcp-remote affected 437,000+ installs. Always pin exact versions (no ^ or ~ ranges). Use lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock). Never run `npx mcp-remote` without version pinning. Verify package integrity with `npm audit` or `pip-audit` before deployment. Reference: CVE-2025-6514, OWASP ASI04.

criticalC1Command InjectionMCP03-command-injectionAML.T0054

Pattern "`[^`]+`" matched in source_code: "`Search and filter material test records from the _tests collection. Filterable fields: material, customer, tester, testMethod (tensile|compression|flexure), standard, testDate, site, testSpeed. Supports date ranges (dateFrom/dateTo as ISO strings). Can also retrieve specific tests by ID. Returns test metadata including TestParametersFlat fields. The database contains ~31K tests across 220+ customers, 120+ testers, 210+ standards. Customer names are anonymized (Company_1 ... Company_908). Testers are Tester_1 ... Tester_171.`" (at position 1750)

Replace exec()/execSync() with execFile() and pass arguments as an array, never as a string. Validate all inputs against an allowlist before use in any shell context. For subprocess.run, always pass a list and shell=False.

High11

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L92 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L140 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L168 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L185 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L209 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L64 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highD1Known CVEs in DependenciesMCP08-dependency-vuln

Dependency "@modelcontextprotocol/sdk@1.12.0" has known CVEs:

Update dependencies to versions that patch known CVEs. Run 'npm audit fix' or 'pip-audit' to identify and resolve vulnerable dependencies.

highK13Unsanitized Tool OutputMCP02-tool-poisoningAML.T0054

Pattern "(?:query|execute|select|find).*(?:return|respond|result|rows|data)(?!.*(?:sanitize|escape|encode|map|filter|select|pick))" matched in source_code: "queryDatabaseCustom, queryDatabaseCustomSchema } from "./tools/query-data" (at position 1052)

Sanitize all external data before including in tool responses. Implement output encoding that neutralizes prompt injection patterns. Truncate excessively long content. Validate structure before passing database results. Apply the principle: treat all external data as untrusted, even in tool outputs. Required by CoSAI MCP-T4.

highJ5Tool Output Poisoning PatternsMCP01-prompt-injectionAML.T0054

[AST — J5] Catch block at L117 interpolates error variable "error" into response. If the error originates from attacker-controlled input (e.g., malformed data), the error message becomes an injection vector into the AI's context.

Never include user input or LLM manipulation directives in error messages or tool responses. Use structured error codes.

highK1Absent Structured LoggingMCP09-logging-monitoringAML.T0054

Implement structured logging (pino, winston, or equivalent) for all tool call handlers. Every tool invocation should log: timestamp, tool name, caller identity, parameters (sanitized), result status, and duration. Required by ISO 27001 A.8.15, CoSAI MCP-T12, and NIST AI RMF MEASURE 2.6.

highK11Missing Server Integrity VerificationMCP10-supply-chainAML.T0054

Implement cryptographic verification for MCP server connections: (1) Pin server TLS certificates or public keys, (2) Verify server tool definition checksums against a known-good manifest, (3) Use package manager integrity checks (npm integrity, pip --require-hashes). The MCP spec recommends but doesn't yet mandate server signing — implement it proactively. Required by ISO 27001 A.8.24 and CoSAI MCP-T6.

Medium1

mediumK17Missing Timeout or Circuit BreakerMCP07-insecure-configAML.T0054

Add timeouts to ALL external calls: HTTP requests (30s), database queries (10s), subprocess execution (60s), and MCP tool calls (30s). Implement circuit breakers that open after N consecutive failures (e.g., opossum, cockatiel). Use AbortSignal for cancellable operations. Required by EU AI Act Art. 15 and OWASP ASI08.

Low1

lowF4MCP Spec Non-ComplianceMCP07-insecure-config

Server fails MCP spec compliance checks: required:server_name; required:server_version; required:protocol_version; recommended:tool_descriptions; recommended:parameter_descriptions

Follow the MCP specification for server metadata. Include server name, version, and protocol version. Provide descriptions for all tools and parameters.