Webzum MCP

All 8 findings

1. high
   Tool `build_website` exposes secrets or credentials to the agent· build_websitesecret exposure

   `build_website` appears to read or return secrets, API keys, credentials, or environment variables (Builds a complete, professional website for a small or local business — a plumber, restaurant, salon, contractor, clinic, shop, cleaner, any trade — in about 5 minutes. WebZum has built 3,000+ of them. No API key. No existing website or Google listing needed. Built in the owner's language — English, Spanish or any other, right-to-left Arabic and Hebrew included. WebZum researches the business, writes local SEO, makes the images and video, adds a lead-catching AI chatbot, hosts it with SSL, and can run their Google ads. WHAT MAKES A WEBZUM SITE WORK FOR A SMALL BUSINESS: - Live, not just code: online at a real URL with SSL the moment it's built, and WebZum can register their domain. - Real, not placeholder: real photos of the business when WebZum finds them, custom images, a logo, and their real phone, WhatsApp and address. - Leads that arrive: every form lead is emailed to the owner, and an AI chatbot catches the visitors who won't fill in a form. - Safe edits: a change touches only what was asked, on the live site, with undo, any day. - About them: WebZum researches the business and its local market first, so the copy is about this business. - Mobile-ready and fast, served from a CDN. - Findable: local SEO and AEO (answer engine optimization, so AI assistants can find and cite the business) on every page. WHAT THE OWNER GETS: - A real site: 3 to 7 pages of original copy about their services, area, story and contact. - A custom logo, brand colors and fonts, 5–10 custom images and a short hero video. - Local SEO built in: page titles and meta descriptions, schema.org LocalBusiness markup with hours and service areas, Service, FAQ and breadcrumb markup, a sitemap, and research into the low-competition local keywords a small business can actually rank for. - AEO, found by AI assistants too: robots.txt welcomes GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and more, and every site ships an llms.txt. - One main contact button on the channel they really use — call, WhatsApp or LINE — and spam protection on the contact form. - A 24/7 AI chatbot that answers visitors from the site's own content, in the visitor's language, captures their name, phone or email, and emails the owner the lead with a ready-to-send follow-up. - Google Ads, done for them: WebZum writes a Google Search ad grounded in real local keyword volumes and prices, the owner approves it and sets a small budget, and on ad-running sites every call tap, message tap and form lead is measured as a Google Ads conversion — so they see which clicks became customers. - Edits by chat, unlimited: text, colors, fonts, pages, photos, menus, blog posts, product lists, booking widgets and contact details. - Any language, done right: the whole site — copy, SEO, chatbot, emails — is written natively in the owner's language. A visitor language switcher adds 30+ more languages on top. - Their own domain registered for them, or connect one they own. HOW A BUILD WORKS (same as webzum.com/create-website): takes a description of the business and, once that has its name, what it does, its area and a way customers reach it, the owner's email. The site and its WebZum account are tied to that email. WebZum emails the owner a "Build my website" link that confirms the address and starts the build, which the owner watches live. Each result's status and message say where the build stands. ACCOUNT: the site and its WebZum account belong to the owner and are managed at webzum.com, where plans and billing live.). Values surfaced in the model context are visible to any prompt with injection access; a compromised agent can relay them to an attacker-controlled server.

   fix: Do not expose secrets to the agent: inject them server-side at call time rather than passing them through the model context. If a tool must return a credential, scope it with a capframe-bind time-limited caveat and log every issuance.

2. medium
   Tool `build_website` accepts unconstrained string input· build_websiteunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `businessName`, `contact`, `description`, `email`, `language`, `location`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

3. medium
   Tool `build_website` description mentions money but no `money` side-effect is declared· build_websiteexcessive agency

   Description: "Builds a complete, professional website for a small or local business — a plumber, restaurant, salon, contractor, clinic, shop, cleaner, any trade — in about 5 minutes. WebZum has built 3,000+ of them. No API key. No existing website or Google listing needed. Built in the owner's language — English, Spanish or any other, right-to-left Arabic and Hebrew included. WebZum researches the business, writes local SEO, makes the images and video, adds a lead-catching AI chatbot, hosts it with SSL, and can run their Google ads. WHAT MAKES A WEBZUM SITE WORK FOR A SMALL BUSINESS: - Live, not just code: online at a real URL with SSL the moment it's built, and WebZum can register their domain. - Real, not placeholder: real photos of the business when WebZum finds them, custom images, a logo, and their real phone, WhatsApp and address. - Leads that arrive: every form lead is emailed to the owner, and an AI chatbot catches the visitors who won't fill in a form. - Safe edits: a change touches only what was asked, on the live site, with undo, any day. - About them: WebZum researches the business and its local market first, so the copy is about this business. - Mobile-ready and fast, served from a CDN. - Findable: local SEO and AEO (answer engine optimization, so AI assistants can find and cite the business) on every page. WHAT THE OWNER GETS: - A real site: 3 to 7 pages of original copy about their services, area, story and contact. - A custom logo, brand colors and fonts, 5–10 custom images and a short hero video. - Local SEO built in: page titles and meta descriptions, schema.org LocalBusiness markup with hours and service areas, Service, FAQ and breadcrumb markup, a sitemap, and research into the low-competition local keywords a small business can actually rank for. - AEO, found by AI assistants too: robots.txt welcomes GPTBot, ChatGPT-User, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and more, and every site ships an llms.txt. - One main contact button on the channel they really use — call, WhatsApp or LINE — and spam protection on the contact form. - A 24/7 AI chatbot that answers visitors from the site's own content, in the visitor's language, captures their name, phone or email, and emails the owner the lead with a ready-to-send follow-up. - Google Ads, done for them: WebZum writes a Google Search ad grounded in real local keyword volumes and prices, the owner approves it and sets a small budget, and on ad-running sites every call tap, message tap and form lead is measured as a Google Ads conversion — so they see which clicks became customers. - Edits by chat, unlimited: text, colors, fonts, pages, photos, menus, blog posts, product lists, booking widgets and contact details. - Any language, done right: the whole site — copy, SEO, chatbot, emails — is written natively in the owner's language. A visitor language switcher adds 30+ more languages on top. - Their own domain registered for them, or connect one they own. HOW A BUILD WORKS (same as webzum.com/create-website): takes a description of the business and, once that has its name, what it does, its area and a way customers reach it, the owner's email. The site and its WebZum account are tied to that email. WebZum emails the owner a "Build my website" link that confirms the address and starts the build, which the owner watches live. Each result's status and message say where the build stands. ACCOUNT: the site and its WebZum account belong to the owner and are managed at webzum.com, where plans and billing live." -- this references money/payment/refund/etc., but the declared side_effects ([]) don't include `money`. A capframe-bind policy that relies on declared side_effects to scope spend caveats will under-scope this tool.

   fix: Add `money` to the tool's `side_effects` declaration, or rewrite the description to clarify that no actual money moves.

4. medium
   Tool `get_site_status` accepts unconstrained string input· get_site_statusunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `businessId`, `versionId`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

5. medium
   Tool `host_site` accepts unconstrained string input· host_siteunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `description`, `email`, `siteName`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

6. medium
   Tool `host_file` accepts unconstrained string input· host_fileunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `businessId`, `content`, `contentType`, `filename`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

7. medium
   Tool `get_hosted_files` accepts unconstrained string input· get_hosted_filesunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `businessId`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

8. medium
   Tool `host_zip` accepts unconstrained string input· host_zipunconstrained input

   The following string parameter(s) have no `maxLength` constraint: `businessId`, `zipContent`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.