Hi,
We have scanned cjo4m06/mcp-shrimp-task-manager twice — March 18 and April 13.
Both scans find the same issues.
Hardcoded credentials — CVSS 9.1 (15 instances)
Credentials or secrets embedded directly in source code. Anyone with read access to the repo has access to these values.
Command injection — CVSS 9.8 (2 instances)
exec() with unsanitized input.
eval() usage — CVSS 9.3 (2 instances)
Full ecosystem comparison:
https://codeslick.dev/blog/mcp-ecosystem-security-rescan-2026
To reproduce: npx codeslick-cli scan --all
— Vitor Lourenço, CodeSlick (https://codeslick.dev)
Hi,
We have scanned cjo4m06/mcp-shrimp-task-manager twice — March 18 and April 13.
Both scans find the same issues.
Hardcoded credentials — CVSS 9.1 (15 instances)
Credentials or secrets embedded directly in source code. Anyone with read access to the repo has access to these values.
Command injection — CVSS 9.8 (2 instances)
exec()with unsanitized input.eval() usage — CVSS 9.3 (2 instances)
Full ecosystem comparison:
https://codeslick.dev/blog/mcp-ecosystem-security-rescan-2026
To reproduce:
npx codeslick-cli scan --all— Vitor Lourenço, CodeSlick (https://codeslick.dev)