[potiuk]

Summary

Two tools that run outside the agent's sandbox trusted inputs the agent controls:

• gmail-plaintext MCP server — credentials_path was unconfined. It is a tool argument, so whoever drives the agent chose it: setup_credentials could write the Gmail refresh token wherever a sandboxed command can read it (defeating the ~/.config/apache-magpie* read deny), and create_draft / check_auth could load a planted credentials file. A caller-supplied path must now be a .json file directly in ~/.config/apache-magpie/ or in the directory of $GMAIL_OAUTH_CREDENTIALS (the server's own configuration, not a tool call), with no symlink on the file or its directory. Omitting it keeps the default lookup.
• vulnogram-api-record-publish — the publish gate was not checked. --allow-state accepted any value, so a DRAFT could be pushed to PUBLIC, and nothing confirmed the advisory had shipped, which is the gate the move stands for. --allow-state is now limited to REVIEW / READY, and the move refuses (new exit code 4, also in dry-run) a record whose references[] has no entry tagged vendor-advisory — the tag generate-cve-json gives the archived advisory URL. The issue-sync publish step documents both.

Type of change

• Python package (tools/gmail/oauth-draft, tools/cve-tool-vulnogram/oauth-api, and their magpie-security-tools copies)
• Skill change (issue-sync/apply-and-push.md: publish preconditions, exit code 4)

Test plan

• prek run on the changed files passes
• pytest for tools/gmail/oauth-draft (with the mcp extra) and tools/cve-tool-vulnogram/oauth-api: all pass
• New tests: setup_credentials refuses a path outside the credential directories (relative, wrong suffix, elsewhere) before running the consent flow or writing anything; a symlinked credentials path is refused; a path in the configured directory is accepted; a record with no vendor-advisory reference (or only a patch one) is not published and nothing is POSTed; --allow-state DRAFT|PUBLIC|REJECTED is rejected
• roborev review clean

RFC-AI-0004 compliance

• Sandbox — closes a credential-exfiltration path through an unsandboxed MCP server
• HITL — CVE publication now requires the shipped-advisory evidence the gate is defined by

---

Gen-AI disclosure: drafted with Claude Code (Opus 5); reviewed by the submitter.

🤖 Generated with Claude Code