Add security warnings to Argument schema definition (#371)

## Summary
- Add comprehensive security warnings to the `Argument` type in
server.schema.json
- Warn about command injection risks from user-provided input in
arguments
- Include concrete example of malicious payload (`;rm -rf
~/Development`)
- Recommend non-shell execution methods and user consent for safer
command execution

Fixes #41
This commit is contained in:
adam jones 2025-09-08 13:40:22 -07:00 • committed by GitHub
commit be6c2d9142
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -330,6 +330,7 @@
]
},
"Argument": {
"description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution.",
"anyOf": [
{
"$ref": "#/$defs/PositionalArgument"