Query Tools

1 finding on this tool

1. criticalexcessive agencyf-r7-query_tools

   Tool `Query Tools` exposes a code/command execution surface

   `Query Tools` looks like it executes code or shell commands (`read_query` - Execute SELECT queries to read data from the database - Input: - `query` (string): The SELECT SQL query to execute - Returns: Query results as array of objects - `write_query` - Execute INSERT, UPDATE, or DELETE queries - Input: - `query` (string): The SQL modification query - Returns: `{ affected_rows: number }` - `create_table` - Create new tables in the database - Input: - `query` (string): CREATE TABLE SQL statement - Returns: Confirmation of table creation). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.

   fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.

   OWASP LLM08NIST MANAGE-2.2ATLAS T0051CAST-01