complete_mission

2 findings on this tool

1. mediumunconstrained inputf-r1-complete_mission

   Tool `complete_mission` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `mission_id`, `session_id`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03
2. mediumexcessive agencyf-r5-complete_mission

   Tool `complete_mission` description mentions money but no `money` side-effect is declared

   Description: "Complete a mission and claim rewards (Mission objectives must be fulfilled. Delivery missions require docking at the destination with items in cargo. Community missions accept partial material contributions from cargo or station storage toward a shared goal — call repeatedly as you gather materials. Rewards include credits, items, and skill XP. Empire mission credit rewards are paid from the issuing empire's treasury and are capped at its balance: if it cannot cover the advertised reward, the response carries `credits_promised` and `credits_shortfall` alongside the `credits_earned` you were actually paid.)" -- this references money/payment/refund/etc., but the declared side_effects ([]) don't include `money`. A capframe-bind policy that relies on declared side_effects to scope spend caveats will under-scope this tool.

   fix: Add `money` to the tool's `side_effects` declaration, or rewrite the description to clarify that no actual money moves.

   OWASP LLM08NIST MEASURE-2.6ATLAS T0040CAST-01