creativelead-unclick

Security Findings (952)

• HighAS-002

  ⚠️Excessive Permissions ×80

  tool declares network permission

  unclick_searchunclick_callunclick_shorten_urlunclick_generate_qrunclick_validate_urlunclick_encoderawg_search_gamesbungie_search_playerbungie_search_entitieslego_search_setslego_search_partsbrickset_searchuntappd_search_beeruntappd_search_brewerydomain_search_listingstrove_searchsearch_trademarkssearch_patentstab_meetingsabn_searchptv_searchsearch_cvevirustotal_scan_urlvirustotal_url_reporturlscan_scanurlscan_get_resulturlscan_searchshodan_searchemail_searchfood_searchtext_extract_urlsmeal_searchdeezer_searchdeezer_search_playlistinstapaper_actiontmdb_search_moviestmdb_search_tvweather_hourlyradio_searchomdb_searchopenlibrary_searchmb_search_artistsmb_search_releasesmb_search_recordingsgenius_searchtm_search_eventstm_search_venuestm_search_attractionsseatgeek_search_eventsseatgeek_search_performersseatgeek_search_venueseventbrite_search_eventsfoursquare_search_placeslastfm_search_artistsdiscogs_search_releasesdiscogs_search_artistssetlistfm_search_artistsetlistfm_search_setlistspodcast_searchpodcast_by_feed_urlpodcast_search_episodesguardian_search_articlesnews_searchstock_searchcrypto_searchtwitch_search_streamstwitch_search_gamesreddit_postreddit_searchmastodon_actionbluesky_actiondiscord_searchtelegram_searchtelegram_send_mediaamazon_searchyelp_search_businessesyelp_search_events

  tool declares exec permission

  toggl_create_time_entryclockify_actionsplitwise_action

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-010

  🔑Insecure Secret Handling ×294

  input parameter "api_key" appears to accept a secret or credential

  rawg_search_gamesrawg_get_gamerawg_game_screenshotsrawg_list_genresrawg_list_platformsrawg_upcoming_gamesriot_summonerriot_rankedriot_match_historyriot_get_matchriot_valorant_accountbungie_search_playerbungie_get_profilebungie_get_manifestbungie_search_entitiescoc_playercoc_clancoc_clan_memberscr_playercr_top_playersbs_playerbs_clublego_search_setslego_get_setlego_set_partslego_search_partslego_themesbrickset_searchbrickset_get_setuntappd_search_beeruntappd_get_beeruntappd_get_breweryuntappd_search_breweryuntappd_beer_activitiesesports_matchesesports_tournamentsesports_teamsesports_playersesports_get_matchamber_sitesamber_current_priceamber_forecastwillyweather_forecastwillyweather_surfwillyweather_tidedomain_search_listingsdomain_get_propertydomain_suburb_statstrove_searchtrove_get_worktrove_newspaper_articleauspost_track_parcelauspost_get_postcodeauspost_delivery_timessendle_get_quotesendle_create_ordersendle_track_parcelsearch_trademarksget_trademark_detailssearch_patentstab_meetingstab_racetab_sports_marketsabn_lookupabn_searchptv_searchptv_departuresptv_disruptionsptv_stops_on_routeptv_route_directionshunter_find_emailhunter_verify_emailhunter_domain_infohibp_check_accountvirustotal_scan_urlvirustotal_url_reportvirustotal_scan_ipvirustotal_scan_domainabuseipdb_check_ipabuseipdb_report_ipabuseipdb_blacklisturlscan_scanurlscan_get_resulturlscan_searchshodan_searchshodan_host_infoshodan_statsresend_send_emailresend_get_emailresend_list_domainsvercel_list_deploymentsvercel_get_deploymentvercel_list_projectsvercel_get_domainvercel_get_envtoggl_time_entriestoggl_create_time_entrytoggl_projectstoggl_summaryebird_recent_observationsebird_notable_observationsebird_species_infocarbon_flight_emissionscarbon_vehicle_emissionscarbon_electricity_emissionsnotion_actionreadwise_actionraindrop_actionclockify_actionsplitwise_actionmonica_actionfeedly_actiontmdb_search_moviestmdb_search_tvtmdb_movietmdb_tvtmdb_trendingtmdb_now_playingtmdb_upcomingtmdb_popular_tvnasa_apodnasa_asteroidsnasa_mars_photosnasa_earth_imagerynasa_epicomdb_searchomdb_by_titleomdb_by_idgenius_searchgenius_get_songgenius_get_artistgenius_artist_songstm_search_eventstm_get_eventtm_search_venuestm_get_venuetm_search_attractionsseatgeek_search_eventsseatgeek_get_eventseatgeek_search_performersseatgeek_get_performerseatgeek_search_venuesseatgeek_get_venueeventbrite_search_eventseventbrite_get_eventeventbrite_get_attendeeseventbrite_create_eventeventbrite_list_categorieseventbrite_get_venuefoursquare_search_placesfoursquare_get_placefoursquare_get_photosfoursquare_get_tipsfoursquare_autocompletelastfm_artist_infolastfm_search_artistslastfm_top_trackslastfm_similar_artistslastfm_chart_top_artistslastfm_chart_top_trackslastfm_album_infodiscogs_search_releasesdiscogs_get_releasediscogs_get_artistdiscogs_search_artistsdiscogs_marketplace_statsdiscogs_get_labelsetlistfm_search_artistsetlistfm_artist_setlistssetlistfm_search_setlistssetlistfm_get_setlistpodcast_searchpodcast_by_feed_urlpodcast_get_episodespodcast_search_episodespodcast_trendingpodcast_recent_episodeslichess_user_gamesfpl_my_teamguardian_search_articlesguardian_get_articleguardian_get_sectionsguardian_get_tagsguardian_get_editionnews_top_headlinesnews_searchnews_get_sourcesstock_quotestock_searchstock_dailystock_intradayforex_ratecrypto_dailycmc_listingscmc_quotescmc_infocmc_trendingcmc_global_metricsforex_latestforex_historicalforex_currenciesforex_convertwise_exchange_rateswise_profilewise_accountswise_create_quoteip_lookupip_batchtomorrow_realtimetomorrow_forecasttomorrow_historyshopify_productsshopify_ordersshopify_customersshopify_inventoryshopify_collectionsshopify_shopshopify_fulfillmentsyelp_search_businessesyelp_get_businessyelp_get_reviewsyelp_search_eventsyelp_autocomplete

  input parameter "password" appears to accept a secret or credential

  hibp_check_passwordemail_sendemail_read_inboxemail_searchemail_getemail_mark_reademail_deleteinstapaper_actionbluesky_action

  input parameter "session_key" appears to accept a secret or credential

  f1_driversf1_positionsf1_lapsf1_pit_stopsf1_car_dataf1_team_radiof1_weather

  input parameter "api_secret" appears to accept a secret or credential

  podcast_searchpodcast_by_feed_urlpodcast_get_episodespodcast_search_episodespodcast_trendingpodcast_recent_episodes

  input parameter "client_secret" appears to accept a secret or credential

  twitch_search_streamstwitch_get_streamtwitch_search_gamestwitch_top_gamestwitch_get_clipstwitch_channel_infotwitch_schedule

  input parameter "access_token" appears to accept a secret or credential

  reddit_readreddit_postreddit_commentreddit_searchreddit_userreddit_votereddit_subscribemastodon_actionshopify_productsshopify_ordersshopify_customersshopify_inventoryshopify_collectionsshopify_shopshopify_fulfillmentsxero_invoicesxero_contactsxero_accountsxero_paymentsxero_bank_transactionsxero_reportsxero_quotesxero_organisation

  input parameter "bot_token" appears to accept a secret or credential

  discord_senddiscord_readdiscord_threaddiscord_reactdiscord_channelsdiscord_membersdiscord_searchslack_actiontelegram_sendtelegram_readtelegram_searchtelegram_send_mediatelegram_get_updatestelegram_manage_chat

  input parameter "secret_key" appears to accept a secret or credential

  amazon_searchamazon_productamazon_browseamazon_variations

  input parameter "master_password" appears to accept a secret or credential

  vault_action

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• MediumAS-002

  ⚠️Excessive Permissions ×23

  tool declares fs permission

  bungie_get_profilesendle_create_ordertoggl_create_time_entryemail_deleteinstapaper_actionhn_usereventbrite_create_eventbandsintown_artistlichess_userchess_playerfpl_managerwise_profilewise_accountswise_create_quotereddit_userreddit_votemastodon_actionbluesky_actiontelegram_get_updates

  tool declares db permission

  search_cveshodan_statsnotion_action

  tool declares env permission

  vercel_get_env

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×92

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  unclick_searchunclick_callunclick_shorten_urlunclick_generate_qrunclick_validate_urlunclick_encodereport_bugrawg_search_gamesbungie_search_playerbungie_search_entitieslego_search_setslego_search_partsbrickset_searchuntappd_search_beeruntappd_search_brewerydomain_search_listingstrove_searchsearch_trademarkssearch_patentstab_meetingsabn_searchptv_searchsearch_cvevirustotal_scan_urlvirustotal_url_reporturlscan_scanurlscan_get_resulturlscan_searchshodan_searchtoggl_create_time_entryemail_sendemail_searchfood_searchfind_nearest_toiletscalc_compound_interesttext_extract_urlsmeal_searchdeezer_searchdeezer_search_playlistclockify_actionsplitwise_actioninstapaper_actionmonica_actiontmdb_search_moviestmdb_search_tvweather_hourlyradio_searchnumber_factomdb_searchopenlibrary_searchmb_search_artistsmb_search_releasesmb_search_recordingsgenius_searchtm_search_eventstm_search_venuestm_search_attractionsseatgeek_search_eventsseatgeek_search_performersseatgeek_search_venueseventbrite_search_eventsfoursquare_search_placeslastfm_search_artistsdiscogs_search_releasesdiscogs_search_artistssetlistfm_search_artistsetlistfm_search_setlistspodcast_searchpodcast_by_feed_urlpodcast_search_episodesguardian_search_articlesnews_searchstock_searchcrypto_searchcountry_allcountry_by_namecountry_by_codecountry_by_regioncountry_by_currencycountry_by_languagetwitch_search_streamstwitch_search_gamesreddit_postreddit_searchmastodon_actionbluesky_actiondiscord_searchtelegram_searchtelegram_send_mediaamazon_searchyelp_search_businessesyelp_search_events

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×12

  tool declares http permission

  report_bugemail_sendfind_nearest_toiletscalc_compound_interestmonica_actionnumber_factcountry_allcountry_by_namecountry_by_codecountry_by_regioncountry_by_currencycountry_by_language

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×451

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  unclick_searchunclick_browseunclick_tool_infounclick_callunclick_shorten_urlunclick_generate_qrunclick_hashunclick_transform_textunclick_validate_emailunclick_validate_urlunclick_resize_imageunclick_parse_csvunclick_json_formatunclick_encodeunclick_generate_uuidunclick_random_passwordunclick_cron_parseunclick_ip_parseunclick_color_convertunclick_regex_testunclick_timestamp_convertunclick_diff_textunclick_kv_setunclick_kv_getreport_bugrawg_search_gamesrawg_get_gamerawg_game_screenshotsrawg_list_genresrawg_list_platformsrawg_upcoming_gamesriot_summonerriot_rankedriot_match_historyriot_get_matchriot_valorant_accountbungie_search_playerbungie_get_profilebungie_get_manifestbungie_search_entitiescoc_playercoc_clancoc_clan_memberscr_playercr_top_playersbs_playerbs_clublego_search_setslego_get_setlego_set_partslego_search_partslego_themesbrickset_searchbrickset_get_setuntappd_search_beeruntappd_get_beeruntappd_get_breweryuntappd_search_breweryuntappd_beer_activitiesesports_matchesesports_tournamentsesports_teamsesports_playersesports_get_matchamber_sitesamber_current_priceamber_forecastwillyweather_forecastwillyweather_surfwillyweather_tidedomain_search_listingsdomain_get_propertydomain_suburb_statstrove_searchtrove_get_worktrove_newspaper_articleauspost_track_parcelauspost_get_postcodeauspost_delivery_timessendle_get_quotesendle_create_ordersendle_track_parcelsearch_trademarksget_trademark_detailssearch_patentstab_meetingstab_racetab_sports_marketslott_resultslott_jackpotsabn_lookupabn_searchptv_searchptv_departuresptv_disruptionsptv_stops_on_routeptv_route_directionsget_cve_detailsearch_cveget_recent_cveshunter_find_emailhunter_verify_emailhunter_domain_infohibp_check_accounthibp_all_breacheshibp_check_passwordvirustotal_scan_urlvirustotal_url_reportvirustotal_scan_ipvirustotal_scan_domainabuseipdb_check_ipabuseipdb_report_ipabuseipdb_blacklisturlscan_scanurlscan_get_resulturlscan_searchshodan_searchshodan_host_infoshodan_statsresend_send_emailresend_get_emailresend_list_domainsvercel_list_deploymentsvercel_get_deploymentvercel_list_projectsvercel_get_domainvercel_get_envtoggl_time_entriestoggl_create_time_entrytoggl_projectstoggl_summaryemail_sendemail_read_inboxemail_searchemail_getemail_mark_reademail_deleteusgs_recent_earthquakesusgs_earthquake_detailusgs_earthquakes_by_regionopenaq_air_qualityopenaq_measurementsopenaq_countriesfood_searchfood_get_productfood_by_categoryebird_recent_observationsebird_notable_observationsebird_species_infocarbon_flight_emissionscarbon_vehicle_emissionscarbon_electricity_emissionsfind_nearest_toiletsget_toilet_detailscalc_tipcalc_mortgagecalc_bmicalc_compound_interestcalc_currency_estimateconvert_lengthconvert_weightconvert_temperatureconvert_volumeconvert_speedconvert_areaconvert_data_storagedatetime_current_timedatetime_convert_timezonedatetime_date_diffdatetime_add_to_datedatetime_business_daysdatetime_format_datedatetime_week_numbertext_analysetext_transformtext_extract_emailstext_extract_urlstext_extract_phone_numberstext_count_occurrencestext_truncatemeal_searchmeal_randommeal_get_by_idmeal_categoriesmeal_filter_by_categorymeal_filter_by_areameal_filter_by_ingredientespn_nfl_scoresespn_nba_scoresespn_mlb_scoresespn_nhl_scoresespn_soccer_scoresespn_newsespn_team_infosleeper_nfl_statesleeper_playerssleeper_trending_playerssleeper_leaguesleeper_league_rosterssleeper_league_matchupsdeezer_searchdeezer_get_artistdeezer_get_albumdeezer_get_trackdeezer_chartdeezer_search_playlistcolor_convertcolor_infocolor_palettecolor_mixcolor_contrast_ratiorandom_uuidrandom_numberrandom_stringrandom_pick_from_listrandom_flip_coinrandom_roll_dicerandom_shuffle_listrandom_lorem_ipsumnotion_actionreadwise_actionraindrop_actionclockify_actionsplitwise_actioninstapaper_actionmonica_actionfeedly_actionhn_top_storieshn_new_storieshn_best_storieshn_ask_hnhn_show_hnhn_itemhn_userf1_sessionsf1_driversf1_positionsf1_lapsf1_pit_stopsf1_car_dataf1_team_radiof1_weathertmdb_search_moviestmdb_search_tvtmdb_movietmdb_tvtmdb_trendingtmdb_now_playingtmdb_upcomingtmdb_popular_tvtrivia_questionstrivia_categoriesnasa_apodnasa_asteroidsnasa_mars_photosnasa_earth_imagerynasa_epicweather_currentweather_forecastweather_hourlyradio_searchradio_by_countryradio_top_clickedradio_top_votedradio_by_tagradio_countriesnumber_factnumber_randomomdb_searchomdb_by_titleomdb_by_idopenlibrary_searchopenlibrary_get_bookopenlibrary_get_editionopenlibrary_get_authoropenlibrary_author_worksopenlibrary_trendingmb_search_artistsmb_search_releasesmb_search_recordingsmb_get_artistmb_get_releasegenius_searchgenius_get_songgenius_get_artistgenius_artist_songstm_search_eventstm_get_eventtm_search_venuestm_get_venuetm_search_attractionsseatgeek_search_eventsseatgeek_get_eventseatgeek_search_performersseatgeek_get_performerseatgeek_search_venuesseatgeek_get_venueeventbrite_search_eventseventbrite_get_eventeventbrite_get_attendeeseventbrite_create_eventeventbrite_list_categorieseventbrite_get_venuefoursquare_search_placesfoursquare_get_placefoursquare_get_photosfoursquare_get_tipsfoursquare_autocompletelastfm_artist_infolastfm_search_artistslastfm_top_trackslastfm_similar_artistslastfm_chart_top_artistslastfm_chart_top_trackslastfm_album_infodiscogs_search_releasesdiscogs_get_releasediscogs_get_artistdiscogs_search_artistsdiscogs_marketplace_statsdiscogs_get_labelsetlistfm_search_artistsetlistfm_artist_setlistssetlistfm_search_setlistssetlistfm_get_setlistbandsintown_artistbandsintown_eventsbandsintown_recommendedpodcast_searchpodcast_by_feed_urlpodcast_get_episodespodcast_search_episodespodcast_trendingpodcast_recent_episodeslichess_userlichess_user_gameslichess_puzzle_dailylichess_top_playerslichess_tournamentchess_playerchess_player_statschess_player_gameschess_puzzles_randomchess_leaderboardsfpl_bootstrapfpl_playerfpl_gameweekfpl_fixturesfpl_my_teamfpl_managerfpl_leagues_classicguardian_search_articlesguardian_get_articleguardian_get_sectionsguardian_get_tagsguardian_get_editionnews_top_headlinesnews_searchnews_get_sourcesstock_quotestock_searchstock_dailystock_intradayforex_ratecrypto_dailycrypto_pricecrypto_coincrypto_searchcrypto_trendingcrypto_top_coinscrypto_coin_historycmc_listingscmc_quotescmc_infocmc_trendingcmc_global_metricsforex_latestforex_historicalforex_currenciesforex_convertwise_exchange_rateswise_profilewise_accountswise_create_quoteip_lookupip_batchcountry_allcountry_by_namecountry_by_codecountry_by_regioncountry_by_currencycountry_by_languagetomorrow_realtimetomorrow_forecasttomorrow_historytwitch_search_streamstwitch_get_streamtwitch_search_gamestwitch_top_gamestwitch_get_clipstwitch_channel_infotwitch_schedulereddit_readreddit_postreddit_commentreddit_searchreddit_userreddit_votereddit_subscribemastodon_actionbluesky_actiondiscord_senddiscord_readdiscord_threaddiscord_reactdiscord_channelsdiscord_membersdiscord_searchslack_actiontelegram_sendtelegram_readtelegram_searchtelegram_send_mediatelegram_get_updatestelegram_manage_chatamazon_searchamazon_productamazon_browseamazon_variationsshopify_productsshopify_ordersshopify_customersshopify_inventoryshopify_collectionsshopify_shopshopify_fulfillmentsyelp_search_businessesyelp_get_businessyelp_get_reviewsyelp_search_eventsyelp_autocompletexero_invoicesxero_contactsxero_accountsxero_paymentsxero_bank_transactionsxero_reportsxero_quotesxero_organisationcsuite_analyzevault_action

  Fix: Review and remediate the identified issue.