shige-f-k-research

Security Findings (190)

• HighAS-003

  🔀Scope Mismatch

  list_service:tool name "list_service" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×30

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  web_researchecosystem_searchocr_extractget_pricingjoin_guildlist_serviceclaim_listingurl_encodeurl_decodeslugifyarxiv_searchurl_metadatahttp_statusrss_fetchcensus_searchexplorer_linkx402_inspectimage_infoagent_card_fetchmcp_introspectmcp_callchain_runchain_saveagent_handshakeqa_askqa_answerqa_searchqa_answer_with_servicequery_parsehaversine

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-002

  ⚠️Excessive Permissions ×31

  declared capabilities: network access

  web_researchocr_extractget_pricingjoin_guildclaim_listingurl_encodeurl_decodeslugifyarxiv_searchurl_metadatahttp_statusrss_fetchcensus_searchexplorer_linkx402_inspectimage_infoagent_card_fetchmcp_introspectmcp_callchain_runagent_handshakeqa_searchhaversine

  declared capabilities: network access, database access

  ecosystem_searchquery_parse

  declared capabilities: code/command execution, network access

  list_servicechain_save

  declared capabilities: HTTP requests

  qa_askqa_answer

  declared capabilities: network access, HTTP requests

  qa_answer_with_service

  declared capabilities: filesystem access

  jsonpath_get

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×127

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  web_researchpubmed_lookupcompetitive_scanecosystem_searchocr_extractengage_sasameget_pricingscope_from_roleguild_feedjoin_guildfind_serviceslist_serviceclaim_listinguuid_generateulid_generatehash_textbase64_encodebase64_decodehex_encodehex_decodeurl_encodeurl_decodehtml_escapejson_formatjson_validatejwt_decodetext_statsregex_matchslugifycase_convertlorem_ipsumpassword_generatecolor_convertnumber_base_convertunit_converttime_convertdate_mathdiff_linesmarkdown_stripcsv_to_jsonjson_to_csvword_frequencysort_linestoken_estimateluhn_checkcount_occurrenceswikipedia_summarydefine_wordhackernews_topgithub_repocrypto_pricefx_rateweathercountry_infodns_lookupip_geolocatearxiv_searchurl_metadatahttp_statusrss_fetchcensus_searchcensus_statsfind_cheapest_servicecompare_serviceseth_block_numbereth_gas_priceeth_balanceeth_txerc721_total_supplyerc8004_registryexplorer_linkens_resolveens_reversex402_inspectimage_infocensus_categoriesagent_card_fetchmcp_introspectmcp_callchain_runerc20_balanceerc20_supplycapability_routerchain_savechain_listchain_invokeagent_handshakeqa_askqa_answerqa_listqa_getqa_upvoteqa_acceptqa_searchqa_suggest_respondersqa_answer_with_servicejson_diffjson_mergejsonpath_getcsv_parsecsv_buildtext_difftemplate_renderstring_similarityllm_token_estimatequery_parsestats_summarygroup_byset_opsjson_flattenjson_unflattensemver_comparecron_nexthaversineshannon_entropyjson_pointernumber_formatbyte_formatduration_formatroman_numeralpercentilehistogramtext_wraparray_chunkarray_dedupematrix_transposeinterval_merge

  Fix: Review and remediate the identified issue.

• InfoAS-010

  🔑Insecure Secret Handling

  jwt_decode:input parameter "token" accepts a credential (informational; not evidence of insecure handling)

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.