sanka-sanka

Security Findings (286)

• HighAS-002

  ⚠️Excessive Permissions ×24

  tool declares network permission

  create_companyupdate_companydownload_order_pdfdownload_estimate_pdfdownload_invoice_pdfdownload_payment_pdfdownload_slip_pdfget_calendar_bootstrap

  tool declares exec permission

  create_itemupdate_itemcreate_taskupdate_taskget_subscriptioncreate_subscriptionupdate_subscriptiondelete_subscriptioncreate_billupdate_billcreate_ticketupdate_ticketcreate_expenseupdate_expensecreate_propertyupdate_property

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-003

  🔀Scope Mismatch

  get_subscription:tool name "get_subscription" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• MediumAS-002

  ⚠️Excessive Permissions ×68

  tool declares fs permission

  create_companyupdate_companydelete_companyupdate_company_price_table_companyupdate_company_price_table_itemcreate_contactupdate_contactdelete_contactcreate_dealupdate_dealdelete_dealcreate_itemupdate_itemdelete_itemcreate_orderupdate_orderdelete_ordercreate_purchase_orderupdate_purchase_orderdelete_purchase_ordercreate_taskupdate_taskdelete_taskcreate_estimateupdate_estimatedelete_estimatecreate_invoiceupdate_invoicedelete_invoicecreate_subscriptionupdate_subscriptiondelete_subscriptioncreate_paymentupdate_paymentdelete_paymentcreate_slipupdate_slipdelete_slipcreate_billupdate_billdelete_billcreate_disbursementupdate_disbursementdelete_disbursementcreate_ticketupdate_ticketdelete_ticketupdate_ticket_statuscreate_locationupdate_locationdelete_locationcreate_inventoryupdate_inventorydelete_inventorycreate_inventory_transactionupdate_inventory_transactiondelete_inventory_transactionupload_expense_attachmentcreate_expenseupdate_expensedelete_expensecreate_propertyupdate_propertydelete_propertycreate_calendar_attendanceupload_import_fileimport_recordspush_integration_sync

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-002

  ⚠️Excessive Permissions ×28

  tool declares http permission

  reply_private_message_thread

  input schema exposes 11 properties (threshold: 10)

  update_dealcreate_ticketupdate_locationcreate_inventoryupdate_inventory_transaction

  input schema exposes 13 properties (threshold: 10)

  create_purchase_orderupdate_ticketupdate_expense

  input schema exposes 14 properties (threshold: 10)

  update_purchase_orderupdate_taskupdate_payment

  input schema exposes 12 properties (threshold: 10)

  create_taskcreate_paymentupdate_inventorycreate_expense

  input schema exposes 15 properties (threshold: 10)

  create_estimatecreate_invoicecreate_slipcreate_disbursementcreate_property

  input schema exposes 16 properties (threshold: 10)

  update_estimateupdate_invoiceupdate_slipupdate_disbursementupdate_property

  input schema exposes 17 properties (threshold: 10)

  create_bill

  input schema exposes 18 properties (threshold: 10)

  update_bill

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×25

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  reply_private_message_threadcreate_companyupdate_companycreate_itemupdate_itemdownload_order_pdfcreate_taskupdate_taskdownload_estimate_pdfdownload_invoice_pdfget_subscriptioncreate_subscriptionupdate_subscriptiondelete_subscriptiondownload_payment_pdfdownload_slip_pdfcreate_billupdate_billcreate_ticketupdate_ticketcreate_expenseupdate_expensecreate_propertyupdate_propertyget_calendar_bootstrap

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×140

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  connect_sankaauth_statuslist_private_messagessync_private_messagesget_private_message_threadreply_private_message_threadarchive_private_message_threadlist_companiesget_companycreate_companyupdate_companydelete_companyget_company_price_tableupdate_company_price_table_companyupdate_company_price_table_itemapply_company_price_table_itemslist_contactsget_contactcreate_contactupdate_contactdelete_contactlist_dealsget_dealcreate_dealupdate_dealdelete_deallist_deal_pipelineslist_itemsget_itemcreate_itemupdate_itemdelete_itemlist_ordersget_orderdownload_order_pdfcreate_orderupdate_orderdelete_orderlist_purchase_ordersget_purchase_ordercreate_purchase_orderupdate_purchase_orderdelete_purchase_orderlist_tasksget_taskcreate_taskupdate_taskdelete_tasklist_estimatesget_estimatedownload_estimate_pdfcreate_estimateupdate_estimatedelete_estimatelist_invoiceslist_overdue_invoicesget_invoicedownload_invoice_pdfcreate_invoiceupdate_invoicedelete_invoicelist_subscriptionsget_subscriptioncreate_subscriptionupdate_subscriptiondelete_subscriptionlist_paymentsget_paymentcreate_paymentupdate_paymentdelete_paymentdownload_payment_pdflist_slipsget_slipcreate_slipupdate_slipdelete_slipdownload_slip_pdflist_billsget_billcreate_billupdate_billdelete_billlist_disbursementsget_disbursementcreate_disbursementupdate_disbursementdelete_disbursementlist_ticketsget_ticketcreate_ticketupdate_ticketdelete_ticketlist_ticket_pipelinesupdate_ticket_statuslist_locationsget_locationcreate_locationupdate_locationdelete_locationlist_inventoriesget_inventorycreate_inventoryupdate_inventorydelete_inventorylist_inventory_transactionsget_inventory_transactioncreate_inventory_transactionupdate_inventory_transactiondelete_inventory_transactionlist_expensesget_expenseupload_expense_attachmentcreate_expenseupdate_expensedelete_expenselist_propertiesget_propertycreate_propertyupdate_propertydelete_propertyget_calendar_bootstrapcheck_calendar_availabilitycreate_calendar_attendancecancel_calendar_attendancereschedule_calendar_attendanceprospect_companiesscore_recordupload_import_fileimport_recordsget_import_joblist_import_jobscancel_import_joblist_integration_channelsexport_recordsget_export_joblist_export_jobscancel_export_jobgenerate_demo_workspacepush_integration_sync

  Fix: Review and remediate the identified issue.