web-agent-protocol

Security Findings (56)

• CriticalAS-006

  💻Arbitrary Code Execution

  heuristic signal

  x711_code_sandbox:tool name or description implies arbitrary script/code execution (evaluate_script, execute javascript, etc.)

  Fix: This tool can execute arbitrary code or shell commands on the host system. Remove it unless strictly required. If kept: (1) restrict access to trusted users/agents only, (2) require human approval before each invocation (Claude Desktop: set approval_required: true; other clients: enable equivalent confirmation), (3) use the most restrictive sandbox or read-only mode available, and (4) never expose this tool to untrusted input sources.

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at vwap-replay-tool-1.0.0: 27 tool(s) added, 4 tool(s) removed without a version bump.

  + 27 added

  x711_agent_actx711_agent_pingx711_agent_reputationx711_agent_seex711_code_sandboxx711_data_retrievalx711_discover_new_toolsx711_email_sendx711_genesis_forgex711_get_latest_gas_stationx711_hallucination_pillx711_hive_consensusx711_hive_readx711_hive_trendingx711_hive_writex711_llm_routingx711_onchain_insightx711_ping_for_updatesx711_price_feedx711_social_oraclex711_strategy_forkx711_strategy_publishx711_swarm_broadcastx711_tx_broadcastx711_tx_simulatex711_web_searchx711_x402_parse

  − 4 removed

  get_catalog_infoget_vendorlookup_vendorsreport_to_outpost

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×11

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  x711_web_searchx711_data_retrievalx711_code_sandboxx711_tx_broadcastx711_email_sendx711_x402_parsex711_strategy_publishx711_strategy_forkx711_agent_seex711_agent_actx711_ping_for_updates

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-002

  ⚠️Excessive Permissions ×15

  declared capabilities: network access, database access, HTTP requests

  x711_web_search

  declared capabilities: database access

  x711_hive_readx711_hive_consensusx711_onchain_insight

  declared capabilities: filesystem access, database access

  x711_hive_write

  declared capabilities: network access

  x711_data_retrieval

  declared capabilities: code/command execution, network access, filesystem access

  x711_code_sandbox

  declared capabilities: code/command execution, network access

  x711_tx_broadcastx711_strategy_publishx711_agent_act

  declared capabilities: HTTP requests

  x711_email_send

  declared capabilities: network access, HTTP requests

  x711_x402_parsex711_agent_see

  declared capabilities: network access, filesystem access

  x711_strategy_forkx711_ping_for_updates

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×27

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  x711_web_searchx711_price_feedx711_hive_readx711_hive_writex711_data_retrievalx711_llm_routingx711_code_sandboxx711_hive_consensusx711_onchain_insightx711_social_oraclex711_agent_pingx711_hive_trendingx711_swarm_broadcastx711_agent_reputationx711_tx_simulatex711_tx_broadcastx711_email_sendx711_x402_parsex711_strategy_publishx711_strategy_forkx711_agent_seex711_agent_actx711_get_latest_gas_stationx711_discover_new_toolsx711_ping_for_updatesx711_hallucination_pillx711_genesis_forge

  Fix: Review and remediate the identified issue.

• InfoAS-010

  🔑Insecure Secret Handling

  x711_social_oracle:input parameter "token" accepts a credential (informational; not evidence of insecure handling)

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.