stevejford1-shiply

Security Findings (195)

• MediumAS-003

  🔀Scope Mismatch ×4

  tool name "set_link" implies local write operation but only remote/network-class permissions were detected

  set_link

  tool name "set_site_access" implies local write operation but only remote/network-class permissions were detected

  set_site_access

  tool name "set_variable" implies local write operation but only remote/network-class permissions were detected

  set_variable

  tool name "set_secret" implies local write operation but only remote/network-class permissions were detected

  set_secret

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×31

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  publish_sitesite_statusverify_siteset_linkset_site_accessget_account_statusfeature_siteset_variabledata_queryadd_domainset_primary_subdomainconnect_providercheck_custom_domaincheck_domaincreate_testverify_claimsummarize_threadreply_to_threadmark_thread_readunarchive_threadcreate_projectarchive_projectcreate_listingupdate_listingrefund_orderget_connect_statuscontract_pdfdeploy_functionset_secretset_cronget_function_logs

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-002

  ⚠️Excessive Permissions ×54

  declared capabilities: network access, filesystem access, HTTP requests

  publish_site

  declared capabilities: network access

  site_statusverify_siteset_linkfeature_siteset_variabledata_queryadd_domainconnect_providercheck_custom_domaincheck_domainmark_thread_readget_connect_statusget_function_logs

  declared capabilities: filesystem access

  delete_siteduplicate_siteexport_accountcreate_drivedrive_list_filesdrive_put_filedrive_delete_filepublish_from_driveset_profiledelete_variableremove_custom_domainremove_domainremove_suppressionget_projectupdate_brieflist_project_filesdelete_listingremove_sending_domaincontract_draftremove_functionremove_secretremove_cron

  declared capabilities: HTTP requests

  set_site_accesssummarize_threadreply_to_threadunarchive_threadarchive_projectrefund_orderset_secret

  declared capabilities: network access, database access

  get_account_statusset_primary_subdomain

  declared capabilities: network access, filesystem access

  create_testverify_claimcreate_projectcreate_listingupdate_listingcontract_pdfset_cron

  declared capabilities: database access

  get_test_status

  declared capabilities: environment variables, HTTP requests

  deploy_function

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-010

  🔑Insecure Secret Handling ×2

  input parameter "claimToken" accepts a credential (informational; not evidence of insecure handling)

  publish_site

  input parameter "password" accepts a credential (informational; not evidence of insecure handling)

  set_site_access

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×104

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  publish_sitesite_statusverify_sitelist_sitesget_sitedelete_siterollback_siteset_handleduplicate_sitepromote_siteset_linkset_site_accessexport_accountwhoamiget_account_statuslist_drivescreate_drivedrive_list_filesdrive_put_filedrive_delete_filepublish_from_driveset_profilefeature_siteset_variablelist_variablesdelete_variabledata_list_collectionsdata_querydata_insertdata_export_collectionadd_domainadd_custom_domainadd_subdomainset_primary_subdomainlist_custom_domainsconnect_providersync_dnscheck_custom_domainremove_custom_domainlist_domainscheck_domainremove_domainget_analyticscreate_testlist_testsget_test_statussend_broadcastresend_confirmationverify_claimlist_inboxread_threadsummarize_threadreply_to_threadmark_thread_readarchive_threadunarchive_threadforward_threadlist_test_inbox_addresseslist_unsubscribeslist_suppressionsadd_suppressionremove_suppressionlist_complaintslist_projectscreate_projectget_projectupdate_briefregenerate_briefarchive_projectrestore_projectlist_project_filesresend_intake_invitelist_listingscreate_listingupdate_listingdelete_listinglist_my_saleslist_my_ordersrefund_orderget_connect_statuslist_sending_domainsadd_sending_domainverify_sending_domainremove_sending_domaincontract_draftcontract_sendcontract_amendcontract_pdfcontract_statusdeploy_functionget_functionremove_functionset_secretlist_secretsremove_secretlist_cronsset_cronremove_cronget_function_logssend_emaillist_site_inboxset_mailboxlist_mailbox_contactssend_mailbox_broadcast

  Fix: Review and remediate the identified issue.