Agent audit rule · v0.1.0
Can run code or commands
The agent can run shell commands, evaluate code, run raw SQL or deploy. Whoever can steer the agent, including text it reads, can run anything that action allows, with the agent's credentials.
- high base severity
- 3 test fixtures
high code-exec-action
Flagged
// tools.json
1 [
2 {
3 > "name": "run_sql",
4 "input_schema": {
5 "type": "object",Fix
Replace the general action with narrow, parameterised ones (a fixed query with typed parameters, a named runbook). If it must stay, run it in a sandbox with no credentials or network, and require an approval.
Fine
[
{
"name": "get_order_status",
"input_schema": {
"type": "object",
"properties": {
"order_id": {
"type": "string"
}
}
}
}
]