commission_ship

2 findings on this tool

1. mediumunconstrained inputf-r1-commission_ship

   Tool `commission_ship` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `session_id`, `ship_class`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03
2. mediumexcessive agencyf-r5-commission_ship

   Tool `commission_ship` description mentions money but no `money` side-effect is declared

   Description: "Commission a ship to be built at this shipyard (Place a build order at the current base's shipyard. Ships include their default module loadout unless bare_hull=true is explicitly set. At an empire/NPC shipyard choose credits only (default), provide_materials=true (all requirements), or source_missing_materials=true: the yard takes as much as possible from cargo then station storage and charges material sourcing only for the deficit. Do not combine the two material flags. All modes pay labor and a yard fee. Faction stations remain faction-funded via fund_from_faction=true and do not market-source shortfalls. Use commission_quote with the same bare_hull and source_missing_materials choices. On completion the server pushes ship_commission_complete.)" -- this references money/payment/refund/etc., but the declared side_effects ([]) don't include `money`. A capframe-bind policy that relies on declared side_effects to scope spend caveats will under-scope this tool.

   fix: Add `money` to the tool's `side_effects` declaration, or rewrite the description to clarify that no actual money moves.

   OWASP LLM08NIST MEASURE-2.6ATLAS T0040CAST-01