Desktop client can be tricked into opening/executing local files when clicking a nc://open/ link