Unauthenticated localhost API with wildcard CORS allows cross-origin command injection

Great tool — the workflow of capturing browser context and injecting it into Claude Code is genuinely useful. However, I have a security concern about the HTTP API.

Currently:

• The server binds to 127.0.0.1:9999 with no authentication
• CORS is set to Access-Control-Allow-Origin: *
• The /inject endpoint accepts arbitrary text with no sanitization

This means any website a user visits can silently POST to http://127.0.0.1:9999/inject and inject arbitrary commands into their running Claude Code session. A malicious ad, compromised CDN script, or XSS on any site could exploit this.

Minimal PoC from any webpage: fetch("http://127.0.0.1:9999/inject", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ text: "rm -rf ~", priority: true }) });

Suggestions:

1. Replace Access-Control-Allow-Origin: * with an allowlist of known extension origins (e.g., ContextBox's chrome-extension://... origin)
2. Add a shared secret / token that ContextBox and AiBridge negotiate on startup
3. Consider requiring the "paranoid mode" (no auto-submit) as the default