worldmonitor

Security Findings (200)

• HighAS-003

  🔀Scope Mismatch

  get_signal_convergence:tool name "get_signal_convergence" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×49

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  get_toronto_reported_occurrencesget_market_dataget_conflict_eventsget_aviation_statusget_news_intelligenceget_military_postureget_cyber_threatsget_economic_dataget_eu_industrial_productionget_prediction_marketsget_sanctions_dataget_cross_border_arrivalsget_energy_intelligenceget_climate_dataget_infrastructure_statusget_supply_chain_dataget_price_and_debt_indicatorsget_capital_flowsget_chokepoint_statusget_positive_eventsget_radiation_dataget_research_signalsget_social_velocityget_defense_industrial_baseget_procurement_opportunitiesget_world_briefget_country_briefget_country_risklist_x_feedget_demographics_capabilityget_maritime_activityget_forecast_theaterssearch_flightssearch_flight_prices_by_dateget_supply_vulnerabilitiesget_signal_convergenceget_population_exposuresearch_intel_historyget_intel_timelineget_similar_eventsget_company_intelligenceget_mcp_allowancedescribe_toolget_news_clustersget_sourcesanalyze_news_headlinesget_macro_historyget_stock_researchget_gold_intelligence

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×95

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  get_country_historyget_toronto_reported_occurrencesget_toronto_calls_attendedget_market_dataget_conflict_eventsget_aviation_statusget_news_intelligenceget_natural_disastersget_military_postureget_cyber_threatsget_economic_dataget_country_macroget_eu_housing_cycleget_eu_quarterly_gov_debtget_eu_industrial_productionget_prediction_marketsget_sanctions_dataget_cross_border_arrivalsget_displacement_dataget_health_signalsget_energy_intelligenceget_oil_trade_seriesget_climate_dataget_imd_cyclone_marineget_infrastructure_statusget_supply_chain_dataget_price_and_debt_indicatorsget_capital_flowsget_chokepoint_statusget_positive_eventsget_radiation_dataget_research_signalsget_forecast_predictionsget_forecast_caseget_forecast_scorecardget_social_velocityget_temporal_anomaliesget_test_site_seismicityget_defense_industrial_baseget_china_decision_signalsget_procurement_opportunitiesget_wto_trade_flowsget_world_briefget_country_briefget_country_riskget_country_coveragelist_x_feedget_food_stocksget_demographics_capabilityget_resilience_indicatorsget_five_factor_scorecardlist_five_factor_scorecardsget_consumer_pricesget_airspaceget_maritime_activityanalyze_situationget_forecast_theaterssearch_flightssearch_flight_prices_by_dateget_commodity_geoget_mineral_productionget_supply_vulnerabilitiesget_chokepoint_dependenciesget_signal_convergenceget_focal_pointssimulate_infrastructure_cascadeget_military_surgeget_population_exposureget_alert_digestget_hotspot_escalationsearch_intel_historyget_intel_timelineget_similar_eventsget_company_intelligenceget_mcp_allowancestart_upgradedescribe_toolclassify_eventextract_entitiesget_news_clustersverify_claimget_keyword_spikesget_sourcesopen_news_dashboardanalyze_news_headlinesget_macro_historyget_stock_researchget_supply_chain_cost_shockcompute_energy_shockget_gold_intelligenceopen_country_briefget_country_brief_sectionget_tariff_averagesget_bilateral_tariffget_us_import_duty

  Fix: Review and remediate the identified issue.

• InfoAS-002

  ⚠️Excessive Permissions ×55

  declared capabilities: network access

  get_toronto_reported_occurrencesget_market_dataget_aviation_statusget_military_postureget_cyber_threatsget_economic_dataget_eu_industrial_productionget_cross_border_arrivalsget_energy_intelligenceget_climate_dataget_infrastructure_statusget_supply_chain_dataget_price_and_debt_indicatorsget_capital_flowsget_chokepoint_statusget_positive_eventsget_radiation_dataget_research_signalsget_social_velocityget_defense_industrial_baseget_procurement_opportunitiesget_world_briefget_country_briefget_country_risklist_x_feedget_demographics_capabilityget_maritime_activityget_forecast_theaterssearch_flightssearch_flight_prices_by_dateget_supply_vulnerabilitiesget_intel_timelineget_similar_eventsdescribe_toolget_sourcesanalyze_news_headlinesget_stock_researchget_gold_intelligence

  declared capabilities: network access, HTTP requests

  get_conflict_events

  declared capabilities: network access, database access

  get_news_intelligenceget_prediction_marketsget_sanctions_datasearch_intel_history

  declared capabilities: filesystem access

  get_oil_trade_seriesget_forecast_predictionsget_forecast_caseget_forecast_scorecard

  declared capabilities: database access

  analyze_situationopen_news_dashboard

  declared capabilities: code/command execution, HTTP requests

  get_signal_convergence

  declared capabilities: HTTP requests

  get_population_exposureget_mcp_allowanceget_news_clustersget_macro_history

  declared capabilities: network access, filesystem access, database access

  get_company_intelligence

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.