pay_bounty

3 findings on this tool

1. highexcessive agencyf-r3-pay_bounty

   Tool `pay_bounty` name implies a side effect that is not declared

   `pay_bounty` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

   OWASP LLM08NIST MEASURE-2.6ATLAS T0051CAST-01
2. mediumunconstrained inputf-r1-pay_bounty

   Tool `pay_bounty` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `empire`, `session_id`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03
3. mediumexcessive agencyf-r5-pay_bounty

   Tool `pay_bounty` description mentions money but no `money` side-effect is declared

   Description: "Settle your outstanding bounty with an empire from anywhere (Clears every uncleared crime you have with one empire — including unpaid income and property tax — and restores the reputation those crimes cost you, up to that empire's cap. Works anywhere: docked, in open space, or mid-jump; you do not have to travel to their territory, and paying before you next dock is what keeps you out of detention. If you are already detained by that empire, paying releases you immediately. Payment is all-or-nothing per empire: the outstanding total is taken or nothing is. Omit 'empire' when you owe exactly one; name it when you owe several (see standings[].outstanding_bounty in get_status). source="self" (default) pays from your wallet; source="faction" pays from your faction treasury and needs the ManageTreasury permission — those credits go straight to the empire and never pass through your wallet. Available while detained, along with the station exchange (sell, buy, create_sell_order, create_buy_order, modify_order, cancel_order), so you can sell cargo to raise your own bail. Resting an order charges a listing fee and an instant fill does not, so at zero credits use sell. Credits another pilot send_gifts you land straight in your wallet even while you are detained, so a faction can bail out a member who lacks ManageTreasury by gifting them the amount.)" -- this references money/payment/refund/etc., but the declared side_effects ([]) don't include `money`. A capframe-bind policy that relies on declared side_effects to scope spend caveats will under-scope this tool.

   fix: Add `money` to the tool's `side_effects` declaration, or rewrite the description to clarify that no actual money moves.

   OWASP LLM08NIST MEASURE-2.6ATLAS T0040CAST-01