better-chatbot

Security Findings (123)

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×14

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  telemetry_querytelemetry_chartuptime_create_incident_tooluptime_list_monitors_tooltelemetry_build_explore_query_tooltelemetry_build_metric_query_tooltelemetry_create_application_tooltelemetry_create_cloud_connection_tooltelemetry_create_source_tooltelemetry_get_errors_query_instructions_tooltelemetry_get_metric_query_instructions_tooltelemetry_get_query_instructions_tooltelemetry_get_replays_query_instructions_toolbetter_stack_search_documentation_tool

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×2

  input schema exposes 12 properties (threshold: 10)

  uptime_create_incident_tool

  input schema exposes 13 properties (threshold: 10)

  uptime_escalate_incident_tool

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-002

  ⚠️Excessive Permissions ×30

  declared capabilities: code/command execution, network access, database access

  telemetry_querytelemetry_chart

  declared capabilities: filesystem access

  uptime_create_incident_comment_tooluptime_create_status_page_report_tooluptime_create_status_page_report_update_tooluptime_get_status_page_report_update_tooluptime_list_status_page_report_updates_tooltelemetry_create_dashboard_tooltelemetry_remove_chart_tooltelemetry_remove_dashboard_section_tooltelemetry_remove_dashboard_tooltelemetry_update_error_state_tool

  declared capabilities: code/command execution, filesystem access

  uptime_create_incident_tool

  declared capabilities: network access

  uptime_list_monitors_toolbetter_stack_search_documentation_tool

  declared capabilities: database access

  telemetry_add_chart_to_dashboard_tooltelemetry_edit_chart_tooltelemetry_get_chart_details_tooltelemetry_get_metric_details_tooltelemetry_get_source_fields_tooltelemetry_list_clusters_tool

  declared capabilities: network access, database access

  telemetry_build_explore_query_tooltelemetry_build_metric_query_tooltelemetry_get_errors_query_instructions_tooltelemetry_get_metric_query_instructions_tooltelemetry_get_query_instructions_tooltelemetry_get_replays_query_instructions_tool

  declared capabilities: network access, filesystem access

  telemetry_create_application_tooltelemetry_create_source_tool

  declared capabilities: network access, filesystem access, database access

  telemetry_create_cloud_connection_tool

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-010

  🔑Insecure Secret Handling ×2

  input parameter "password" accepts a credential (informational; not evidence of insecure handling)

  telemetry_querytelemetry_chart

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×75

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  telemetry_querytelemetry_chartuptime_acknowledge_incident_tooluptime_create_incident_comment_tooluptime_create_incident_tooluptime_escalate_incident_tooluptime_get_incident_comments_tooluptime_get_incident_tooluptime_get_incident_escalation_options_tooluptime_get_incident_timeline_tooluptime_list_incidents_tooluptime_resolve_incident_tooluptime_get_escalation_policy_tooluptime_get_severity_tooluptime_list_escalation_policies_tooluptime_list_severities_tooluptime_get_monitor_availability_tooluptime_get_monitor_tooluptime_get_monitor_response_times_tooluptime_list_monitors_tooluptime_get_heartbeat_availability_tooluptime_get_heartbeat_tooluptime_list_heartbeats_tooluptime_get_on_call_tooluptime_get_on_call_event_tooluptime_get_on_call_rotation_tooluptime_list_on_call_events_tooluptime_list_on_calls_tooluptime_create_status_page_report_tooluptime_create_status_page_report_update_tooluptime_get_status_page_tooluptime_get_status_page_resources_tooluptime_get_status_page_report_update_tooluptime_list_status_page_reports_tooluptime_list_status_pages_tooluptime_list_status_page_report_updates_tooltelemetry_add_chart_to_dashboard_tooltelemetry_add_dashboard_section_tooltelemetry_build_explore_query_tooltelemetry_build_metric_query_tooltelemetry_create_application_tooltelemetry_create_cloud_connection_tooltelemetry_create_dashboard_tooltelemetry_create_source_tooltelemetry_edit_chart_tooltelemetry_export_dashboard_tooltelemetry_get_application_details_tooltelemetry_get_chart_building_instructions_tooltelemetry_get_chart_details_tooltelemetry_get_dashboard_details_tooltelemetry_get_error_details_tooltelemetry_get_errors_query_instructions_tooltelemetry_get_metric_details_tooltelemetry_get_metric_query_instructions_tooltelemetry_get_metrics_and_cardinality_tooltelemetry_get_query_instructions_tooltelemetry_get_replays_query_instructions_tooltelemetry_get_source_details_tooltelemetry_get_source_fields_tooltelemetry_import_dashboard_tooltelemetry_list_applications_tooltelemetry_list_clusters_tooltelemetry_list_dashboard_templates_tooltelemetry_list_dashboards_tooltelemetry_list_data_regions_tooltelemetry_list_releases_tooltelemetry_list_sources_tooltelemetry_list_teams_tooltelemetry_move_charts_tooltelemetry_remove_chart_tooltelemetry_remove_dashboard_section_tooltelemetry_remove_dashboard_tooltelemetry_rename_dashboard_tooltelemetry_update_error_state_toolbetter_stack_search_documentation_tool

  Fix: Review and remediate the identified issue.