Agent audit rule · v0.1.0
Broad OAuth scope
The scope gives access to all of the user's (or the tenant's) data of that kind, not only what the agent needs. High when the scope can send as the user, administer users or groups, or run code.
- medium base severity
- 3 test fixtures
medium broad-oauth-scope
Flagged
// tools.json
1 [
2 > "https://www.googleapis.com/auth/drive"
3 ]Fix
Request the narrowest scope that works, for example Google `drive.file` instead of `drive`, a per-user Graph permission instead of `*.All`, or a fine-grained GitHub token instead of `repo`.
Fine
[
"https://www.googleapis.com/auth/drive.file"
]