namewhisper-ens-tools

Security Findings (61)

• HighAS-002

  ⚠️Excessive Permissions ×7

  tool declares network permission

  search_ens_namesset_ens_recordssearch_agent_directoryget_caller_identitysearch_knowledge

  tool declares exec permission

  find_alphamake_offer

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-003

  🔀Scope Mismatch

  find_alpha:tool name "find_alpha" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• MediumAS-002

  ⚠️Excessive Permissions ×2

  tool declares db permission

  search_ens_names

  tool declares fs permission

  search_agent_directory

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• MediumAS-003

  🔀Scope Mismatch

  set_ens_records:tool name "set_ens_records" implies local write operation but only remote/network-class permissions were detected

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×11

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  search_ens_namesget_valuationfind_alphamake_offerset_ens_recordswrap_nameunwrap_namemanage_fusessearch_agent_directoryget_caller_identitysearch_knowledge

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×5

  tool declares http permission

  get_valuationwrap_nameunwrap_namemanage_fusesget_caller_identity

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×34

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  search_ens_namesget_name_detailscheck_availabilityget_similar_namesget_valuationget_market_activitywash_checkget_wallet_portfoliofind_alphaget_primary_nameprovision_agent_identitymake_offerpurchase_namebulk_registerrenew_ens_nametransfer_ens_nameset_ens_recordsbulk_set_recordsbulk_transfer_ens_namesset_primary_nameset_resolvermanage_ens_namewrap_nameunwrap_namemanage_fusesmint_subnamesextend_subname_expiryapprove_operatorreclaim_nameget_agent_reputationsearch_agent_directoryget_caller_identitysearch_knowledgeget_usage_stats

  Fix: Review and remediate the identified issue.