recowork

handleViewerRequest (lines 304-359) dispatches on pathname only; neither the Host header nor Origin is validated and no token is required. A malicious web page can rebind its own hostname to 127.0.0.1 and then fetch /api/workspace, /api/document?path=..., /api/search and /api/asset (any .md/.png/.svg under the opened project) as same-origin, exfiltrating the user's notes/project documents while the viewer is running.

getViewerAssetContentType whitelists SVG and respondFile returns it inline without Content-Disposition, nosniff or CSP. If a repository the user opens (or a document image link) ships a crafted SVG and the user navigates directly to /api/asset?path=..., its script executes in the viewer origin and can then call the workspace APIs to dump every Markdown document. Rendering as <img> is safe, so this needs a direct navigation.

The string is rendered into the workspace AGENTS.md (rule_open_workspace_viewer), i.e. it becomes an instruction the local coding agent follows on its own. `npx --yes` installs and runs whatever the mutable `latest` tag points to, on the developer machine, without a user confirmation prompt or integrity pin, so an npm account compromise or a bad publish executes with the agent's privileges.

initTemplate aborts only when rw-manifest.json already exists (line 697); otherwise it runs fs.mkdirSync(targetDir) and copyIfExists/copyDir/copyTemplateAssets/renderTargetFiles with plain copyFileSync/writeFileSync. Pointing `rw add <template> .` at a directory that already has a README.md (or files named like template assets) silently replaces those user files with no backup or prompt.