build-mcp-use-agent

The script has a command-injection vulnerability in hasCommand(): untrusted command names are inserted into a bash -lc command using JSON.stringify rather than shell-safe argument handling. Malicious --server-command input or a crafted command: value in scanned source can cause shell code execution when diagnostics run. No other clear malicious behavior is evident.