GHSA-g7jf-m9pq-rhmx: 
Python Analyse et atténuation de la vulnérabilité

Summary

README says the agent "never gets a shell, never reads evidence or writes the workspace outside the audit log". Two gaps undercut that boundary. An agent that is steered by content inside hostile evidence (prompt injection) can use them.

1. Option injection (CWE-88). Several MCP tools append the agent-supplied path as the last positional argument of a CLI and never check it for a leading -:
   • run_clamav: ["clamscan", "-r", "--no-summary", target_path]
   • run_strings, run_hashdeep, run_exiftool, run_ssdeep (extract/misc.py)
   • the yara scans (yara.py)
   • run_mmls (extract/tsk.py)
   • log2timeline (extract/plaso.py) A path such as --log=/any/file becomes a flag.
2. Path containment is per-tool (CWE-22).
   • path_policy.resolve_allowed_path guards only list_directory and read_evidence_file, plus extract_to of extract_archive. Most other path-taking tools pass the raw string to the filesystem or a subprocess.
   • One of the two allowed roots is evidence_root, which the agent itself sets through scan_evidence(evidence_path) without validation.

PoC

Tested against main @ 10628fa with ClamAV 1.5.4, calling the real tool functions on a temporary case:

Impact

A prompt-injected agent gets file write/append and deletion primitives through clamscan (--log, --remove, --move, --copy), plus the equivalent flags of the other tools. It can also read host files through any unguarded tool. Every call is still audited, but nothing prevents it.

Fix

The fix branch I will push to the temporary private fork handles part 1:

• A helpers.cli_path() rewrites a leading - to ./-….
• It is applied at every positional-path call site above.
• Tests include one that drives the real clamscan (--log= no longer creates a file). Part 2 is a design choice for the maintainer, so I did not change it. Options:
• Apply resolve_allowed_path to every path-taking tool.
• Pin evidence_root from the CLI (for example alongside MULDER_CASE_ID) instead of taking it from scan_evidence.