Shell MCP (wcgw) — agentic threat model
Shell MCP (wcgw) presents a critical security risk due to its ability to execute arbitrary shell commands directly on the host macOS system with user permissions. Without sandboxing or strict input validation, any prompt injection vulnerability in the connected agent can lead to complete host compromise.
OWASP AIVSS score rationale
| Autonomy of Action | 0.90 | |
| Goal-Driven Planning | 0.80 | |
| Self-Modification | 0.60 | |
| Dynamic Tool Use | 1.00 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.40 | |
| Multi-Agent Interactions | 0.50 | |
| Non-Determinism | 0.80 | |
| Opacity & Reflexivity | 0.70 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — the tool is model-agnostic, but any connected foundation model is highly vulnerable to prompt injection, which directly translates to arbitrary code execution on the host system.
Not certain from the listing — there is no explicit mention of data operations, vector databases, or training pipelines, though the shell tool could theoretically read or exfiltrate local files.
The framework integrates directly with shell execution tools, creating an extremely high-risk path where natural language prompts are translated into system-level commands without strict validation.
Runs directly on the host macOS system with the user's permissions, lacking default sandboxing or containerization, which permits full host compromise and potential lateral movement.
Not certain from the listing — there are no mentioned logging, guardrails, or observability features to detect malicious shell commands or anomalous execution patterns.
Not certain from the listing — no authentication, authorization policies, or access control mechanisms are described, meaning it inherits the full privileges of the running user.
Not certain from the listing — while designed as an MCP tool for other agents, there are no built-in controls to prevent cascading failures or unauthorized cross-agent command execution.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).