Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary

token-optimizer-mcp is vulnerable to OS command injection in the smart_user tool.

The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync():

getent passwd "${username}" || grep "^${username}:" /etc/passwd