This is a test/fixture server with intentionally planted security issues and prompt-injection attacks in tool descriptions. Tool 2 (read_notes) contains a prompt-injection attack in its description attempting to override system instructions. Tool 3 (list_recent_files) accepts arbitrary shell commands despite being described as read-only, creating command-injection vulnerability. Tool 4 embeds a fake AWS credential in its description. While schemas are present with basic structure, descriptions are compromised by malicious content. This server is NOT production-ready and appears designed to test security scanning, not serve as a reference implementation.

• Remove prompt-injection attack from read_notes description. Replace with: 'Read a saved note by its ID. Returns the note content and metadata. Read-only operation.'
• Remove 'command' parameter from list_recent_files or redesign as separate tool (execute_shell_command) with explicit destructive/irreversible annotation. Current design violates least-privilege principle.
• Remove embedded credential from summarize_document description. Use environment variable injection for any real credentials needed.
• Add error handling guidance to all tool descriptions: 'Returns error if [resource not found|permission denied|timeout]. Retry-safe: yes/no.'
• Document output schemas for all tools. Currently only input schemas are visible; LLMs need to know what fields to expect in responses.