write_pdf

2 findings on this tool

1. highexcessive agencyf-r3-write_pdf

   Tool `write_pdf` name implies a side effect that is not declared

   `write_pdf` looks like a side-effecting tool (its name contains a mutation verb), but its `side_effects` declaration is []. A policy synthesizer cannot produce safe rules for this tool because it cannot tell what it actually does.

   fix: Declare the tool's true side effects explicitly. If the tool is genuinely read-only, rename it to match (e.g. `email.preview` rather than `email.send`).

   OWASP LLM08NIST MEASURE-2.6ATLAS T0051CAST-01
2. highfilesystem egressf-r9-write_pdf

   Tool `write_pdf` writes to or deletes from the host filesystem

   `write_pdf` appears to write, create, move, or delete files on the host filesystem ( Create a new PDF file or modify an existing one. THIS IS THE ONLY TOOL FOR CREATING AND MODIFYING PDF FILES. RULES ABOUT FILENAMES: - When creating a new PDF, 'outputPath' MUST be provided and MUST use a new unique filename (e.g., "result_01.pdf", "analysis_2025_01.pdf", etc.). MODES: 1. CREATE NEW PDF: - Pass a markdown string as 'content'. write_pdf(path="doc.pdf", content="# Title\n\nBody text...") 2. MODIFY EXISTING PDF: - Pass array of operations as 'content'. - NEVER overwrite the original file. - ALWAYS provide a new filename in 'outputPath'. - After modifying, show original file path and new file path to user. write_pdf(path="doc.pdf", content=[ { type: "delete", pageIndexes: [0, 2] }, { type: "insert", pageIndex: 1, markdown: "# New Page" } ]) OPERATIONS: - delete: Remove pages by 0-based index. { type: "delete", pageIndexes: [0, 1, 5] } - insert: Add pages at a specific 0-based index. { type: "insert", pageIndex: 0, markdown: "..." } { type: "insert", pageIndex: 5, sourcePdfPath: "/path/to/source.pdf" } PAGE BREAKS: To force a page break, use this HTML element: <div style="page-break-before: always;"></div> Example: "# Page 1\n\n<div style=\"page-break-before: always;\"></div>\n\n# Page 2" ADVANCED STYLING: HTML/CSS and inline SVG are supported for: - Text styling: colors, sizes, alignment, highlights - Boxes: borders, backgrounds, padding, rounded corners - SVG graphics: charts, diagrams, icons, shapes - Images: <img src="/absolute/path/image.jpg" width="300" /> or  Supports standard markdown features including headers, lists, code blocks, tables, and basic formatting. Only works within allowed directories. IMPORTANT: Always use absolute paths for reliability. Paths are automatically normalized regardless of slash direction. Relative paths may fail as they depend on the current working directory. Tilde paths (~/...) might not work in all contexts. Unless the user explicitly asks for relative paths, use absolute paths. This command can be referenced as "DC: ..." or "use Desktop Commander to ..." in your instructions.). An agent manipulated by an indirect-injection payload can target sensitive paths (SSH keys, shell configs, application secrets) or establish persistence via cron / systemd.

   fix: Restrict the tool to an explicit allow-list of safe directories. Validate all path parameters server-side, reject traversal sequences (`../`), and gate write / delete operations behind a capframe-bind `path starts_with /safe/dir` caveat.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051CAST-01