favcrm-favcrm

Security Findings (252)

• HighAS-002

  ⚠️Excessive Permissions ×28

  tool declares network permission

  search_membersget_contactsearch_crmgenerate_imagegenerate_post_coverupload_post_cover_from_urlreplace_post_blockrequest_send_approvallist_knowledge_documents

  tool declares exec permission

  create_serviceupdate_servicecreate_service_categorycreate_resourcecreate_ticketcreate_taskupdate_taskcreate_promotioncreate_service_packageupdate_service_packagecreate_postupdate_postcreate_categoryupdate_categorycreate_segmentcreate_productupdate_productcreate_product_categorycreate_offer_rule

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• MediumAS-002

  ⚠️Excessive Permissions ×51

  tool declares fs permission

  get_member_profilecreate_serviceupdate_servicecreate_service_scheduleupdate_service_schedulecreate_service_categorycreate_resourceupdate_booking_settingscreate_ticketupdate_ticket_statusupdate_deal_stagecreate_contactupdate_contactcreate_taskupdate_taskcreate_campaignupdate_campaigndelete_campaigncreate_broadcastcreate_notecreate_promotionupdate_promotiondelete_promotioncreate_service_packageupdate_service_packagedelete_service_packagecreate_postupdate_postdelete_postgenerate_post_coverupload_post_cover_from_urlcreate_categoryupdate_categorydelete_categorycreate_post_typecreate_post_type_fieldupdate_post_typedelete_post_typeupdate_post_type_fielddelete_post_type_fieldappend_post_blockremove_post_blockcreate_bookingfind_or_create_workroom_threadcreate_segmentcreate_productupdate_productcreate_product_categorycreate_variationupdate_order_statuscreate_offer_rule

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-002

  ⚠️Excessive Permissions ×12

  input schema exposes 18 properties (threshold: 10)

  search_members

  input schema exposes 20 properties (threshold: 10)

  create_service

  input schema exposes 17 properties (threshold: 10)

  update_servicecreate_promotionupdate_post

  input schema exposes 12 properties (threshold: 10)

  create_service_scheduleupdate_service_schedule

  tool declares http permission

  send_whatsapp_messagecreate_noterequest_send_approvalsend_message

  input schema exposes 16 properties (threshold: 10)

  create_post

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×29

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  search_memberscreate_serviceupdate_servicecreate_service_categorycreate_resourcecreate_ticketget_contactcreate_taskupdate_tasksend_whatsapp_messagesearch_crmcreate_notecreate_promotioncreate_service_packageupdate_service_packagecreate_postupdate_postupload_post_cover_from_urlcreate_categoryupdate_categoryreplace_post_blockrequest_send_approvalsend_messagecreate_segmentcreate_productupdate_productcreate_product_categorycreate_offer_rulelist_knowledge_documents

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×132

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  search_membersget_member_profilelist_tagsattach_tagslist_tiersget_membership_tierissue_rewardsenrol_membershipget_loyalty_balanceearn_loyalty_pointsget_dashboard_statslist_bookingsget_booking_detailget_booking_statsget_available_slotslist_servicesget_service_detailcreate_serviceupdate_servicecreate_service_schedulelist_service_schedulesupdate_service_scheduleassign_staff_to_servicelink_resource_to_servicelist_service_categoriescreate_service_categorycreate_resourceset_resource_availabilityset_staff_availabilityget_booking_settingsupdate_booking_settingslist_ticketsget_ticket_statscreate_ticketupdate_ticket_statuslist_dealsupdate_deal_stagelist_contactsget_contactcreate_contactupdate_contactlist_taskscreate_taskupdate_tasksend_whatsapp_messagesearch_crmlist_invoiceslist_subscriptionslist_campaignscreate_campaignupdate_campaigndelete_campaignsend_campaignvalidate_campaignsend_test_campaignlist_notification_logslist_conversationscreate_broadcastclonelist_notescreate_noteconfirm_bookingcancel_bookingcomplete_bookingmark_no_showlist_promotionsget_promotioncreate_promotionupdate_promotiondelete_promotionvalidate_promotionlist_reward_schemeslist_stafflist_resourceslist_service_packagesget_service_packagecreate_service_packageupdate_service_packagedelete_service_packagelist_my_companiesswitch_companylist_postsget_postcreate_postupdate_postdelete_postlist_image_modelsgenerate_imagegenerate_post_coverattach_post_cover_from_jobupload_post_cover_from_urllist_categoriescreate_categoryupdate_categorydelete_categorylist_post_typescreate_post_typelist_post_type_fieldscreate_post_type_fieldupdate_post_typedelete_post_typeupdate_post_type_fielddelete_post_type_fieldreorder_post_type_fieldsappend_post_blockreplace_post_blockremove_post_blockreorder_post_blockscreate_bookingget_conversation_messagesfind_or_create_workroom_threadpost_workroom_messagerequest_send_approvalsend_messagelist_segmentsget_segment_memberscreate_segmentlist_productsget_productcreate_productupdate_productlist_product_categoriescreate_product_categorycreate_variationlist_ordersget_orderupdate_order_statuslist_offer_rulesget_offer_rulecreate_offer_rulelist_knowledge_documentslist_shipping_methods

  Fix: Review and remediate the identified issue.