espionage

2 findings on this tool

1. mediumunconstrained inputf-r1-espionage

   Tool `espionage` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `session_id`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03
2. mediumexcessive agencyf-r5-espionage

   Tool `espionage` description mentions money but no `money` side-effect is declared

   Description: "Send a spy to gather intelligence on the station you're docked at, using your faction's Espionage HQ (Requires faction membership, an active Espionage HQ facility built anywhere by your faction, and being docked at the target station. Takes about a minute and a half; no other actions can be taken until it resolves. Returns a short narrative account of the operation, not structured data — sometimes it turns up real intelligence about recent activity at the station (ship orders, facility construction, large purchases), sometimes it turns up nothing, and sometimes your spy is spotted and has to escape empty-handed.)" -- this references money/payment/refund/etc., but the declared side_effects ([]) don't include `money`. A capframe-bind policy that relies on declared side_effects to scope spend caveats will under-scope this tool.

   fix: Add `money` to the tool's `side_effects` declaration, or rewrite the description to clarify that no actual money moves.

   OWASP LLM08NIST MEASURE-2.6ATLAS T0040CAST-01