vp-interaction-routing

No clear evidence of intentional malware/backdoor in this module. However, there is a significant security risk: when include_screenshot is enabled, the bridge reads local filesystem content from a path derived from app-server-provided screenshot.url and returns it as base64 in the MCP response. If screenshot.url can be influenced to target arbitrary paths, this becomes an information disclosure/exfil primitive. Additionally, CODEX_CUA_BRIDGE_AUTO_APPROVE can bypass approval gating, and the bridge executes JS via a node_repl tool (though tool/function names are constrained).