GHSA-vcv2-r9jh-99m5

## Summary `agentic-flow` versions `<= 2.0.13` MCP server tools interpolated attacker-influenceable tool parameters (e.g. `agent`, `task`, `name`, `language`, `agentdb` arguments) directly into shell command strings passed to `execSync()`. A malicious value reaching any of the affected MCP tools could break out of the surrounding double-quoted argument and execute arbitrary OS commands with the privileges of the user running the MCP server. This was a partial-fix gap: prior commit `6a06854` (#158) fixed CWE-78 elsewhere in the project but missed the MCP server files entirely. ## Impact Any MCP tool argument that the AI agent treats as data but the implementation interpolates into a shell command string becomes a command-injection vector. In MCP deployments where untrusted content (web pages, files, third-party tool output) is processed by the agent, this is reachable without direct attacker access to the host. The HTTP/SSE transports (`http-sse.ts`, `http-streaming-updated.ts`) expose the same sinks without authentication or Origin/Host validation, which may raise the effective severity in any deployment that binds them to a reachable network interface. ## Affected components - `src/mcp/standalone-stdio.ts` — `agentic_flow_agent`, `agentic_flow_create_agent`, `agentic_flow_list_all_agents`, `agentic_flow_agent_info`, `agentic_flow_check_conflicts`, `agentic_flow_optimize_model`, `agentic_flow_list_agents`, `agent_booster_edit_file`, `agent_booster_batch_edit`, `agent_booster_parse_markdown`, `agentdb_stats`, `agentdb_pattern_store`, `agentdb_pattern_search`, `agentdb_pattern_stats` - `src/mcp/fastmcp/servers/claude-flow-sdk.ts` - `src/mcp/fastmcp/servers/stdio-full.ts` - `src/mcp/fastmcp/servers/http-streaming-updated.ts` - `src/mcp/fastmcp/servers/http-sse.ts` - `src/mcp/fastmcp/servers/poc-stdio.ts` - `src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts` - `src/mcp/fastmcp/tools/swarm/orchestrate.ts` - `src/mcp/fastmcp/tools/hooks/pretrain.ts` (depth path