mcp.hakuto-0209.com

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool returns shell commands intended to be executed by the calling agent that will replace local files (agent, legal, preset, template files) that differ from a remote source. It accepts an optional base_url parameter to redirect the update source. If an attacker can influence this base_url (via prompt injection or a modified request), the agent could be induced to fetch and execute file-replacement commands from an untrusted origin, resulting in arbitrary local file tampering/supply-chain compromise. The .bak safety note mitigates data loss but does not prevent malicious code/config from being installed. Consider requiring explicit user confirmation before executing returned update commands and disallowing/validating the base_url override, and require agent to show the exact commands before running them.