Agent audit rule · v0.1.0
Can send sensitive data out
The agent can read sensitive data (health records, personal identifiers, financial data or credentials) and can also send to a destination it chooses (an email recipient, URL or webhook). A prompt injection in anything it reads can make it send that data out. Only strong evidence counts: a sensitive parameter name, an explicit description phrase or a declared data class on one side, a free destination on the other. High for health data or credentials, or in a healthcare or fintech agent.
- medium base severity
- 4 test fixtures
medium external-send-sensitive
Flagged
// tools.json
1 [
2 {
3 > "name": "send_email",
4 "input_schema": {
5 "type": "object",Fix
Restrict the send to fixed or allow-listed recipients, require an approval before sending, or split reading and sending into separate agents. Strip or redact sensitive fields before they reach the send action.
Fine
[
{
"name": "send_email",
"input_schema": {
"type": "object",
"properties": {
"to": {
"type": "string"
},
"body": {
"type": "string"
}
}
}
},
{
"name": "get_customer",
"input_schema": {
"type": "object",
"properties": {
"id": {
"type": "string"
}
}
}
}
]