move_file

2 findings on this tool

1. highfilesystem egressf-r9-move_file

   Tool `move_file` writes to or deletes from the host filesystem

   `move_file` appears to write, create, move, or delete files on the host filesystem ( Move or rename files and directories. Can move files between directories and rename them in a single operation. Both source and destination must be within allowed directories. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

   fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051CAST-01
2. mediumunconstrained inputf-r1-move_file

   Tool `move_file` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `destination`, `source`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03