get_quotes

2 findings on this tool

1. highexcessive agencyf-r4-get_quotes

   Tool `get_quotes` accepts an unbounded monetary / quota value

   The numeric parameter(s) `amount` have a money/quota-shaped name but no `maximum` constraint. An LLM tricked by indirect-injection can call the tool with arbitrarily large values.

   fix: Add a `maximum` (and ideally `minimum`) to each money/quota numeric, OR enforce the cap via a capframe-bind `--limit` caveat at the agent boundary.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051CAST-01
2. highsecret exposuref-r10-get_quotes

   Tool `get_quotes` exposes secrets or credentials to the agent

   `get_quotes` appears to read or return secrets, API keys, credentials, or environment variables (Get swap quotes for exchanging one crypto asset to another. Returns available quotes with exchange rates, fees, and estimated output amounts. API key is optional.). Values surfaced in the model context are visible to any prompt with injection access; a compromised agent can relay them to an attacker-controlled server.

   fix: Do not expose secrets to the agent: inject them server-side at call time rather than passing them through the model context. If a tool must return a credential, scope it with a capframe-bind time-limited caveat and log every issuance.

   OWASP LLM06NIST MANAGE-2.2ATLAS T0040CAST-01