Skip to content

Security findings: hardcoded credentials (15 instances) + command injection (CVSS 9.8) #119

Description

@VitorLourenco

Hi,

We have scanned cjo4m06/mcp-shrimp-task-manager twice — March 18 and April 13.
Both scans find the same issues.

Hardcoded credentials — CVSS 9.1 (15 instances)
Credentials or secrets embedded directly in source code. Anyone with read access to the repo has access to these values.

Command injection — CVSS 9.8 (2 instances)
exec() with unsanitized input.

eval() usage — CVSS 9.3 (2 instances)

Full ecosystem comparison:
https://codeslick.dev/blog/mcp-ecosystem-security-rescan-2026

To reproduce: npx codeslick-cli scan --all

— Vitor Lourenço, CodeSlick (https://codeslick.dev)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions