Agent audit rule · v0.1.0
No agent manifest
Without a manifest the audit cannot compare what the agent can do with the roles it acts for, its approvals or its limits. Approval-based findings are reported one level lower because an approval may exist in code.
- low base severity
- 2 test fixtures
low no-manifest
Flagged
// tools.json
1 > [
2 {
3 "name": "get_widget",Fix
Add an agent manifest (`agent:`, `roles:`, `approvals:`, `limits:`, `out_of_scope:`) next to the spec. See CONTRIBUTING.md for the format.
Fine
// tools.json
[
{
"name": "get_widget",
"input_schema": {
"type": "object",
"properties": {}
}
}
]
// agent.json
{
"agent": {
"name": "Widget bot"
}
}