forked from bchanot/claude
docs(mcp): job8 B — document component_builder callback-injection risk
BDR-059 + LRN-110 + LRN-111. Confirmed A's ask-gate covers component_builder (mcp__ scope) — no code fix possible or attempted, it's third-party package code (dist/utils/callback-server.js:36). README MCP section now documents the risk and why the mitigation is ask-gating, not patching.
This commit is contained in:
Bastien Chanot
@@ -79,6 +79,7 @@ rules:
|
||||
| BDR-056 | 2026-07-07 | job6: deps policy = latest gated by integration, not KEEP-PINNED by default | accepted |
|
||||
| BDR-057 | 2026-07-07 | job7: secrets by reference not by value; redact at capture, not just at rest | accepted |
|
||||
| BDR-058 | 2026-07-07 | job8: darwin-skill reinstall full pinned tree, detached HEAD (skills CLI single-file-fetch gap) | accepted |
|
||||
| BDR-059 | 2026-07-07 | job8: explicit ask-gate for all 4 magic MCP tools, empty allow stays empty | accepted |
|
||||
|
||||
---
|
||||
|
||||
@@ -899,3 +900,12 @@ rules:
|
||||
- **Why**: user picked reinstall-pinned over remove/keep-broken (job8 audit §4 item 4, 3-way choice). Unverifiable skill can't be trusted; user wants the optimizer kept, not removed.
|
||||
- **Alternatives rejected**: remove entry (kills wanted function); keep as-is (fails job8's own audit bar — unverifiable); flat-copy without `.git` (matches other 34 dormant skills' convention but drops verifiable pin — kept `.git` detached instead, darwin-skill now 2nd real SHA-pin in the whole trust chain after gstack, job8 report §5).
|
||||
- **Reference**: `~/.agents/skills/darwin-skill/` (detached HEAD `7c7b790`), `~/.agents/.skill-lock.json` (untouched, hash still accurate), backup at `~/.agents/skills/.job8-backups/`. Outside this repo — no commit here covers the file placement itself, this entry is the record. Git-commit whole-`.claude/skills`-tree scope (job8 C.2, `SKILL.md:115/201`) NOT restricted — 3rd-party pinned code, patching it breaks the pin; accepted as documented risk, human-checkpoint-gated per job8 report. Linked to [[LRN-109]].
|
||||
|
||||
## BDR-059 — job8: explicit ask-gate for all 4 magic MCP tools, empty allow stays empty
|
||||
|
||||
- **Date**: 2026-07-07
|
||||
- **Status**: accepted
|
||||
- **Decision**: `settings.json` `permissions.ask` now explicitly lists all 4 `mcp__magic__*` tools (`21st_magic_component_builder`, `21st_magic_component_refiner`, `21st_magic_component_inspiration`, `logo_search`). `permissions.allow` gets ZERO magic entries — no allowlist tightening, the job8 report's "frictionless" diff (allowlist logo_search + inspiration) was explicitly rejected. Confirmation required on every magic call, no exceptions, no auto-exec ever, no wildcard.
|
||||
- **Why**: job8 §3/§4 found zero real `mcp__magic__*` invocations ever (transcript census) and one SUSPECT finding (`21st_magic_component_builder` unauthenticated callback-injection channel, [[LRN-110]]). Prior state relied on undocumented absence-means-ask fallthrough — user wants the gate EXPLICIT so it can't silently regress if `permissions.allow` ever gets a careless wildcard or the default-mode semantics change.
|
||||
- **Alternatives rejected**: leave everything absent (report's own recommended default) — works today but is silent/undocumented, exactly the posture the user wanted to close; allowlist `logo_search` + `21st_magic_component_inspiration` for frictionless design work (job8 report §3 "frictionless" diff) — explicitly declined, real usage is zero so friction costs nothing.
|
||||
- **Reference**: `settings.json` `permissions.ask`, commit `bb7f25a`. Linked to [[LRN-110]] (component_builder risk), [[LRN-111]] (empty-allowlist validity when usage is zero).
|
||||
|
||||
@@ -123,6 +123,8 @@ rules:
|
||||
| LRN-105 | 2026-07-06 | explorer subagent ran a build tool (`graphify .`) mid read-only audit despite prose instructions to only Read/Grep/Bash-read — the runtime observed a config-protection sentinel deny message and self-corrected only after an explicit main-session correction, not from the original prompt | dispatching any "read-only audit" subagent whose toolset includes Bash: state "do not execute build/generator/mutating commands" explicitly, don't rely on "read-only" framing alone to constrain tool CHOICE |
|
||||
| LRN-106 | 2026-07-06 | job3-B1 froze a fixture + repointed run-reconcile.sh's T2 off the live registry, declared "unblocked", 20/20 green — job4 (next audit, same file, same day) found T3+T5 in the SAME FILE still read the live registry, same fragility, untouched | fixing one instance of a "reads live state it shouldn't" finding: grep the WHOLE file (not just the cited line) for the same pattern before declaring the class closed |
|
||||
| LRN-109 | 2026-07-07 | job8: `skills` CLI (vercel-labs/skills) fetches only `skillPath` (often just SKILL.md), not sibling refs/scripts/templates the skill text references — darwin-skill install gap, not drift/tamper | installing/auditing any skill via the `skills` CLI whose SKILL.md references relative paths — verify those paths exist post-install, don't trust `skillFolderHash` alone |
|
||||
| LRN-110 | 2026-07-07 | job8: `21st_magic_component_builder` (magic MCP) opens unauth'd 127.0.0.1 callback server, CORS `*`, no token check, 10min window — any local POST lands verbatim in the tool result the model consumes = local prompt-injection channel | any MCP tool that opens a local callback/listener server to receive async results — check auth + origin scoping on the listener, not just the outbound call |
|
||||
| LRN-111 | 2026-07-07 | job8: empty permissions.allow for a risky MCP tool is a VALID posture (not a gap) when transcript census shows zero real invocations — pre-authorizing unused surface buys nothing, ask-gate costs nothing | deciding whether to allowlist any tool/command — check real usage before assuming "no entry = todo" |
|
||||
|
||||
---
|
||||
|
||||
@@ -1109,3 +1111,15 @@ rules:
|
||||
- **context**: job8 audit flagged darwin-skill NOT-CLEAN — SKILL.md references `references/*.md`, `scripts/*.mjs`, `templates/*.html`, all absent on disk. Traced to `~/.agents/.skill-lock.json`: `skillPath: "SKILL.md"` — installer fetched that ONE file, never the sibling dirs the skill text points to. Upstream repo (public clone, verified) had them all at the exact commit already recorded (`skillFolderHash` matches) — not drift, an installer-scope gap.
|
||||
- **future application**: any skill installed via `skills` CLI whose SKILL.md references relative paths needs a post-install check those paths exist on disk — `skillFolderHash` only hashes what WAS fetched, says nothing about what's missing. If absent: clone source repo at the recorded hash, copy full tree in, keep `.git` detached (cheap real pin, beats trusting the CLI's opaque hash alone).
|
||||
- **cousin**: [[BDR-058]] (this job's fix), darwin-skill's OVERSCOPED git-commit finding (job8 report — 3rd-party code, not patched, accepted risk under human-checkpoint gating, twin of [[LRN-105]]'s no-execute mandate for OUR read-only audits).
|
||||
|
||||
## LRN-110 — magic MCP `component_builder`'s local callback server = unauthenticated prompt-injection channel
|
||||
|
||||
- **context**: job8 audit read `dist/utils/callback-server.js:36` (+ `create-ui.js:35-38`) in the installed `@21st-dev/magic` package. `21st_magic_component_builder` opens a plain HTTP server on `127.0.0.1:9221+`, `Access-Control-Allow-Origin: *`, no token/origin check, staying open up to 10 minutes per call. Whatever body a POST to `/data` carries gets injected VERBATIM into the tool result the model then consumes — any local process or an open browser tab on the same machine can win the race against the legitimate browser hand-back.
|
||||
- **future application**: this is in the third-party package's code, not our config — don't try to patch a vendored/npx-installed dependency. The only real lever is on OUR side of the boundary: never allowlist a tool with this shape, keep it `ask`-gated so a human sees every invocation (see [[BDR-059]]). Applies to any MCP tool whose implementation opens a listener to receive async results, not just this one — check the listener's auth/origin scoping when auditing MCP server code, the tool's *description* text tells you nothing about it.
|
||||
- **cousin**: [[BDR-059]] (the settings fix), [[LRN-111]] (why the allowlist stays empty), job8 report §2 surface 1 finding A#0.
|
||||
|
||||
## LRN-111 — empty allowlist is a valid, deliberate posture when real usage is zero, not a leftover gap
|
||||
|
||||
- **context**: job8 census (grepping real `"name":"mcp__…"` tool_use blocks across `~/.claude/projects`, not text mentions) found ~910 mentions of `mcp__magic__*` but ZERO real invocations, ever. `permissions.allow`/`permissions.ask` had no `mcp__*` entries at all before this job — job6 flagged that as "ZERO scoping", easy to misread as an oversight to fix by adding an allowlist.
|
||||
- **future application**: before treating "no entry for tool X" as a gap needing an allowlist, check real usage first (grep tool_use blocks, not prose mentions). If usage is zero, pre-authorizing costs nothing to skip and buys nothing to add — the honest fix is making the ask-gate EXPLICIT (so it can't regress silently), not granting allow access nobody needs yet. Only add allow entries when real, measured, recurring usage justifies removing the friction.
|
||||
- **cousin**: [[BDR-059]], [[LRN-110]], [[LRN-088]] (same family: measure before assuming an absence is a defect).
|
||||
|
||||
@@ -229,6 +229,21 @@ There is no `claude mcp add` flag that writes the reference form for you —
|
||||
the `${VAR}` syntax has to be typed by hand (or via a wrapper script), same as
|
||||
above.
|
||||
|
||||
### magic MCP (`@21st-dev/magic`) — known callback-injection risk
|
||||
|
||||
`21st_magic_component_builder` opens an **unauthenticated** local callback
|
||||
server (`127.0.0.1:9221+`, `Access-Control-Allow-Origin: *`, no token/origin
|
||||
check) for up to 10 minutes per call; any local process or open browser tab
|
||||
can `POST` to it and that body is injected **verbatim** into the tool result
|
||||
the model consumes (job8 audit, `dist/utils/callback-server.js:36`). This is
|
||||
in the third-party package's code, not this repo's config — **we don't patch
|
||||
it**. The mitigation lives entirely on our side: `settings.json`
|
||||
`permissions.ask` explicitly lists all 4 `mcp__magic__*` tools ([[BDR-059]]),
|
||||
so every call — builder included — requires a live confirmation and can
|
||||
never auto-execute. Don't allowlist
|
||||
`21st_magic_component_builder` or `21st_magic_component_refiner` (arbitrary
|
||||
absolute-path read → vendor exfil, same audit) under any circumstance.
|
||||
|
||||
---
|
||||
|
||||
## Diagnostic and maintenance
|
||||
|
||||
Reference in New Issue
Block a user